CVE-2026-23370

A flaw was found in the dell-wmi-sysman component of the Linux kernel. This vulnerability occurs because the set_new_password() function incorrectly hex dumps the entire buffer, which includes sensitive plaintext password data. A local attacker could exploit this to disclose user credentials, leading to unauthorized access.

This flaw affects Dell systems using the dell-wmi-sysman driver for BIOS password management. The debug hex dump exposes plaintext current and new passwords to kernel logs (dmesg). A local user with access to kernel logs could retrieve BIOS passwords. This is an information disclosure issue rather than code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict access to kernel logs (dmesg) via kernel.dmesg_restrict sysctl setting.