Executive brief
The Linux kernel's Dell WMI (Windows Management Instrumentation) driver contains a buffer indexing error in the handler for the ultra performance keyboard key. This may allow an attacker with physical access to a Dell system to trigger a buffer overread when the special key is pressed, potentially exposing kernel memory or causing a denial of service.
Technical details
A buffer overread vulnerability exists in drivers/platform/x86/dell/dell-wmi-base.c in the dell_wmi_process_key() function. When handling ultra performance key events (type 0x0012, code 0x000d), the code incorrectly indexes the buffer with offset [2] instead of [0], causing it to read beyond the intended data field. The vulnerable component receives pre-parsed WMI event data, and the buffer pointer already points to the first data field; the incorrect offset causes an out-of-bounds read. Exploitation requires physical access to trigger the key event. A patch corrects the buffer index from buffer[2] to buffer[0].
Affected products
- Linux Linux Kernel Linux 5.x through 7.x (affected via platform/x86/dell/dell-wmi-base.c)
Timeline
- 2026-09-17: disclosed: CVE-2026-93129 published
- 2026-06-12: patched: Upstream fix committed (commit adfd6846bea13667ff28f8aaf00c32fbd69825ab)
- 2026-09-14: patched: Fix backported to stable tree (commit 392c19faec6bf4cb72fb02322e2a61e198dd8f72)