---
id: CVE-2026-89444
title: 'platform/x86: dell-wmi-sysman: Don''t hex dump attribute security buffer'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer

  set_attribute() populates the security area of the BIOS attribute request
  buffer with the curre…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: vendor
cwe:
  - CWE-256
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e8a60aa7404bfef37705da5607c97737073ac38d <
    23ba9a18896e198f837ae54be99c8852c41890f7
  - >-
    Linux >= e8a60aa7404bfef37705da5607c97737073ac38d <
    26f554f9f0fb603f76291c10b1cf979241bd2273
  - >-
    Linux >= e8a60aa7404bfef37705da5607c97737073ac38d <
    44ec7f1113309a93d0f250bcd49285d21dd1470e
  - >-
    Linux >= e8a60aa7404bfef37705da5607c97737073ac38d <
    ceeee18c927958b74a04b92cf084fc496fa21e8b
  - >-
    Linux >= e8a60aa7404bfef37705da5607c97737073ac38d <
    22222f92b0a5116eb4aac4be81e7b770adfa32ee
  - >-
    Linux >= e8a60aa7404bfef37705da5607c97737073ac38d <
    eb73b9d51490bec4f73ac6efdba5ac535fcfee74
  - >-
    Linux >= e8a60aa7404bfef37705da5607c97737073ac38d <
    83c80495e45eddf64c6525fb582d8db68f256b71
  - Linux 5.11
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:46:53.734Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89444'
references:
  - url: 'https://git.kernel.org/stable/c/23ba9a18896e198f837ae54be99c8852c41890f7'
  - url: 'https://git.kernel.org/stable/c/26f554f9f0fb603f76291c10b1cf979241bd2273'
  - url: 'https://git.kernel.org/stable/c/44ec7f1113309a93d0f250bcd49285d21dd1470e'
  - url: 'https://git.kernel.org/stable/c/ceeee18c927958b74a04b92cf084fc496fa21e8b'
  - url: 'https://git.kernel.org/stable/c/22222f92b0a5116eb4aac4be81e7b770adfa32ee'
  - url: 'https://git.kernel.org/stable/c/eb73b9d51490bec4f73ac6efdba5ac535fcfee74'
  - url: 'https://git.kernel.org/stable/c/83c80495e45eddf64c6525fb582d8db68f256b71'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89444.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89444'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532198'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89444'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89444'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89444.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00211
epssPercentile: 0.11316
ingestedAt: '2026-09-14T15:23:07.453Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer

set_attribute() populates the security area of the BIOS attribute request
buffer with the current admin password via populate_security_buffer(), then
dumps the whole request buffer with print_hex_dump_bytes(). This can expose
the plaintext admin password in the kernel log.

The same issue was fixed for the password attribute path by
commit d1a196e0a6dc ("platform/x86: dell-wmi-sysman: Don't hex dump
plaintext password data"). Remove the remaining dump from the BIOS
attribute path.

## Affected

- `Linux >= e8a60aa7404bfef37705da5607c97737073ac38d < 23ba9a18896e198f837ae54be99c8852c41890f7`
- `Linux >= e8a60aa7404bfef37705da5607c97737073ac38d < 26f554f9f0fb603f76291c10b1cf979241bd2273`
- `Linux >= e8a60aa7404bfef37705da5607c97737073ac38d < 44ec7f1113309a93d0f250bcd49285d21dd1470e`
- `Linux >= e8a60aa7404bfef37705da5607c97737073ac38d < ceeee18c927958b74a04b92cf084fc496fa21e8b`
- `Linux >= e8a60aa7404bfef37705da5607c97737073ac38d < 22222f92b0a5116eb4aac4be81e7b770adfa32ee`
- `Linux >= e8a60aa7404bfef37705da5607c97737073ac38d < eb73b9d51490bec4f73ac6efdba5ac535fcfee74`
- `Linux >= e8a60aa7404bfef37705da5607c97737073ac38d < 83c80495e45eddf64c6525fb582d8db68f256b71`
- `Linux 5.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89444.json)