CVE-2026-89444

A flaw was found in the Linux kernel. The dell-wmi-sysman driver, responsible for managing Dell WMI (Windows Management Instrumentation) system attributes, incorrectly logs sensitive information. Specifically, when setting a BIOS attribute, the driver populates a security buffer with the current administrator password and then inadvertently dumps the entire buffer, including the plaintext password, into the kernel log. This can lead to the disclosure of the administrator password to any user with access to the kernel logs.

A sensitive information disclosure exists in dell-wmi-sysman because set_attribute can place the current BIOS admin password into the BIOS attribute request buffer and then dump that buffer to the kernel log. A local attacker with access to kernel logs can recover the plaintext BIOS admin password after an administrator or management process changes a BIOS attribute. For the CVSS the PR:L value is used because practical exploitation requires a local user or service context that can read dmesg or journal logs, but not necessarily full root privileges. The issue is not network reachable and is not a memory corruption bug. Impact is primarily high confidentiality loss, with possible limited integrity risk if the exposed BIOS password is later used to change firmware settings.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.