CVE-2026-23370: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23370 is an information disclosure vulnerability in the Linux kernel's platform/x86: dell-wmi-sysman driver. The set_new_password() function performs a hex dump of an entire buffer containing plaintext password data — including both current and new passwords — to kernel logs, inadvertently leaking credentials. It affects Linux kernel versions from 5.11 through multiple stable branches, with fixed versions including 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc3. Disclosed on March 25, 2026, it carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-256 (Plaintext Storage of a Password). Within the dell-wmi-sysman kernel driver, the set_new_password() function calls a hex dump routine on the full WMI buffer before it is processed, writing both the current and new passwords in plaintext to the kernel ring buffer (accessible via dmesg or /var/log/kern.log). Exploitation requires only local access with low privileges — an attacker who can read kernel logs can trivially extract the credentials. No special preconditions beyond local system access are needed, and no public proof-of-concept code has been identified (Red Hat CVE, Feedly).

Successful exploitation allows a local attacker with low privileges to read plaintext Dell WMI system administration credentials (both current and new passwords) directly from kernel logs. This credential exposure could enable unauthorized access to Dell system administration interfaces, BIOS/UEFI settings, or other privileged functions, potentially facilitating privilege escalation or persistent system compromise. The vulnerability has no direct availability or integrity impact, but the confidentiality breach on multi-user systems or post-initial-access scenarios is significant (Red Hat CVE).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), reflecting a very low probability of exploitation in the near term. No threat actor attribution has been reported.

1. Local Access: Obtain a local shell on a Dell system running a vulnerable Linux kernel version (5.11 through the unpatched stable branches) with the dell-wmi-sysman driver loaded.
2. Trigger Password Change: Initiate or observe a Dell WMI password change operation (e.g., via the /sys/bus/wmi/drivers/dell-wmi-sysman/ sysfs interface), which causes set_new_password() to be called internally.
3. Read Kernel Logs: Execute dmesg or read /var/log/kern.log (requires appropriate permissions, typically available to users in the adm group or with CAP_SYSLOG) to retrieve the hex dump output containing plaintext current and new passwords.
4. Extract Credentials: Parse the hex dump from the kernel log to recover the plaintext password strings for use in further attacks against Dell system administration interfaces.

• Logs: Unexpected or repeated reads of /var/log/kern.log or execution of dmesg by non-root, low-privilege users; kernel log entries containing hex dump output from the dell-wmi-sysman driver around password change events.
• Process: Unusual processes (e.g., scripts or tools) reading from /dev/kmsg or invoking dmesg without administrative context.
• File System: Presence of scripts or tools designed to parse kernel log output for credential patterns in user home directories or /tmp.

Apply the patched Linux kernel versions: 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, or 7.0-rc3 and later, which remove the hex dump call from set_new_password() (Red Hat CVE, kernel.org patches). Debian and SUSE have also released updated packages addressing this issue (Debian DSA, SUSE Advisory). As an interim workaround on systems that cannot be immediately patched, restrict access to kernel logs by setting kernel.dmesg_restrict=1 via sysctl and limiting membership in the adm group.

Red Hat tracked the issue via Bugzilla (BZ#2451225) and published a CVE advisory promptly after disclosure (Red Hat Bugzilla). Debian and SUSE issued security advisories and updated packages for their respective distributions (Debian DSA, SUSE Advisory). No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability.