platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer
Summary
| CVE | CVE-2026-89444 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-11 20:19:24 UTC |
| Updated | 2026-09-14 13:19:01 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer set_attribute() populates the security area of the BIOS attribute request buffer with the current admin password via populate_security_buffer(), then dumps the whole request buffer with print_hex_dump_bytes(). This can expose the plaintext admin password in the kernel log. The same issue was fixed for the password attribute path by commit d1a196e0a6dc ("platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data"). Remove the remaining dump from the BIOS attribute path. |
Risk And Classification
EPSS: 0.002000000 probability, percentile 0.099560000 (date 2026-09-14)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected e8a60aa7404bfef37705da5607c97737073ac38d 23ba9a18896e198f837ae54be99c8852c41890f7 git | Not specified |
| CNA | Linux | Linux | affected e8a60aa7404bfef37705da5607c97737073ac38d 26f554f9f0fb603f76291c10b1cf979241bd2273 git | Not specified |
| CNA | Linux | Linux | affected e8a60aa7404bfef37705da5607c97737073ac38d 44ec7f1113309a93d0f250bcd49285d21dd1470e git | Not specified |
| CNA | Linux | Linux | affected e8a60aa7404bfef37705da5607c97737073ac38d ceeee18c927958b74a04b92cf084fc496fa21e8b git | Not specified |
| CNA | Linux | Linux | affected e8a60aa7404bfef37705da5607c97737073ac38d 22222f92b0a5116eb4aac4be81e7b770adfa32ee git | Not specified |
| CNA | Linux | Linux | affected e8a60aa7404bfef37705da5607c97737073ac38d eb73b9d51490bec4f73ac6efdba5ac535fcfee74 git | Not specified |
| CNA | Linux | Linux | affected e8a60aa7404bfef37705da5607c97737073ac38d 83c80495e45eddf64c6525fb582d8db68f256b71 git | Not specified |
| CNA | Linux | Linux | affected 5.11 | Not specified |
| CNA | Linux | Linux | unaffected 5.11 semver | Not specified |
| CNA | Linux | Linux | unaffected 5.15.221 5.15.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.188 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.157 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.109 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.50 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2.4 7.2.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.3-rc1 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/26f554f9f0fb603f76291c10b1cf979241bd2273 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/22222f92b0a5116eb4aac4be81e7b770adfa32ee | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/eb73b9d51490bec4f73ac6efdba5ac535fcfee74 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/23ba9a18896e198f837ae54be99c8852c41890f7 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/ceeee18c927958b74a04b92cf084fc496fa21e8b | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/44ec7f1113309a93d0f250bcd49285d21dd1470e | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/83c80495e45eddf64c6525fb582d8db68f256b71 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.