Executive brief
A vulnerability was identified in the Linux kernel's Dell Systems Management driver. This driver allows the operating system to communicate with Dell-specific hardware settings. An issue in how the driver handles configuration data from the system firmware could allow for memory corruption, potentially leading to system instability or unauthorized access if a malicious or malformed firmware configuration is processed.
Technical details
The vulnerability exists in the populate_enum_data() function within drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c. The driver aggregates firmware-provided 'value-modifier' and 'possible-value' strings into fixed 512-byte buffers using strcat() without verifying if the combined length exceeds the destination buffer size. While individual strings were bounded, the cumulative aggregation was not, leading to a potential heap or stack buffer overflow depending on the struct's allocation. An attacker with the ability to influence firmware-provided WMI objects could trigger this overflow. The fix introduces a bounded append helper using strscpy() and rejects packages that exceed the MAX_BUFF limit.
Affected products
- Linux Linux Kernel 5.11 to 5.15.209, 6.1.175, 6.6.141, 6.12.91
Timeline
- 2026-04-08: other: Patch submitted by developer
- 2026-06-24: disclosed: CVE published
- 2026-06-24: patched: Fixes merged into various stable kernel branches
References
- https://git.kernel.org/stable/c/3c34471c26abc52a37f5ad90949e2e4b8027eb14
- https://git.kernel.org/stable/c/5a04f9a36930792f6d64e28d43609e158d09b665
- https://git.kernel.org/stable/c/75c738d4f27fa18a2a033de153bd40302bde6a66
- https://git.kernel.org/stable/c/7b3dc1f764bf24eb99474a5de8173b0b43a8b071
- https://git.kernel.org/stable/c/90b118d264845f7aaf539ac49f7c75f1f29590e2
- https://git.kernel.org/stable/c/ba0843c1955864401295f7ba3b420afe19f2266d
- https://git.kernel.org/stable/c/c5683ca4949a514fbe656c6d0d08c4c126e21db9