CVE-2025-38412

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks

After retrieving WMI data blocks in sysfs callbacks, check for the validity of them before dereferencing their content.

The vulnerability lies in the lack of validation on ACPI package structures retrieved through WMI sysfs callbacks in the dell-wmi-sysman driver. A local user with sysfs access can trigger a kernel crash or potentially leak memory by crafting malformed ACPI responses or racing access.

Enabled only for the latest version of the Red Hat Enterprise Linux 9 (and after).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module dell-wmi-sysman from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.