CVE-2026-89444

Not scored yetLast modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer

set_attribute() populates the security area of the BIOS attribute request buffer with the current admin password via populate_security_buffer(), then dumps the whole request buffer with print_hex_dump_bytes(). This can expose the plaintext admin password in the kernel log.

The same issue was fixed for the password attribute path by commit d1a196e0a6dc ("platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data"). Remove the remaining dump from the BIOS attribute path.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= e8a60aa7404bfef37705da5607c97737073ac38d, < 23ba9a18896e198f837ae54be99c8852c41890f7; >= e8a60aa7404bfef37705da5607c97737073ac38d, < 26f554f9f0fb603f76291c10b1cf979241bd2273; >= e8a60aa7404bfef37705da5607c97737073ac38d, < 44ec7f1113309a93d0f250bcd49285d21dd1470e; >= e8a60aa7404bfef37705da5607c97737073ac38d, < ceeee18c927958b74a04b92cf084fc496fa21e8b; >= e8a60aa7404bfef37705da5607c97737073ac38d, < 22222f92b0a5116eb4aac4be81e7b770adfa32ee; >= e8a60aa7404bfef37705da5607c97737073ac38d, < eb73b9d51490bec4f73ac6efdba5ac535fcfee74; >= e8a60aa7404bfef37705da5607c97737073ac38d, < 83c80495e45eddf64c6525fb582d8db68f256b71
LinuxLinux5.11

References

Timeline

Published
Sep 11, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-894458.8In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix UAF in selftest IOPF reporting IOMMUFD selftest TRIGGER_ICVE-2026-89446In the Linux kernel, the following vulnerability has been resolved: iommufd: Release current IOAS on xa_store() failure iommufd_take_all_iCVE-2026-89447In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufd_access_nCVE-2026-894489.3In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the cCVE-2026-89449In the Linux kernel, the following vulnerability has been resolved: iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_deCVE-2026-89457.5Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151.CVE-2026-894508.8In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field tegCVE-2026-89451In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle->dev before the SVA handle is visible iommu_attaCVE-2026-894528.4In the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state on registration failure msm_iommu_probe(CVE-2026-89453In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommu_call_iopf_noCVE-2026-89454In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interruCVE-2026-89455In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix use-after-free of event IRQs during teardown plda_pcie_
CVE-2026-89444: Unscored | Vulnix