Executive brief
The Linux kernel's Dell privacy driver (used to manage hardware privacy features like microphone mutes on Dell systems) contains a race condition where a data structure could be freed while another part of the code is still trying to access it. An attacker with local access could potentially trigger this condition to cause a kernel crash or potentially execute arbitrary code.
Technical details
The vulnerability is a race condition in the `dell_privacy_has_mic_mute()` function in the dell-privacy driver. The function accesses the `priv->features_present` field without holding the `list_mutex` lock, allowing the `priv` data structure to be freed by concurrent code while it is being accessed. This is a use-after-free vulnerability. An attacker with local code execution capability can trigger concurrent access patterns to exploit this flaw. The fix involves using the `guard(mutex)` macro to ensure the mutex is held throughout the critical section where `priv` is accessed. Patches are available in the Linux kernel stable releases.
Affected products
- Linux Linux kernel Multiple versions prior to patched releases
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Patch commits 239ae86b7c97341f49d2ba32037ee3ddbaf0f1ab and 2d2108685a491b369f95774d0a7579d6e5287215