CVE-2026-93129 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: dell-wmi-base: Fix handling of ultra performance key
The commit message of commit 5fbd827eb9c2 ("platform/x86: dell-wmi: Recognise or support new switches") states that the ultra performance key contains additional data after the type and code fields. The event data passed to dell_wmi_process_key() is already parsed, so "buffer" already starts after those two fields.
Use the correct index for accessing the first data field to avoid a potential buffer overread.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in the Linux kernel's platform/x86 subsystem specifically affects the dell-wmi-base driver, which is responsible for interpreting hardware events from Dell laptops via the Windows Management Instrumentation interface. This particular flaw arises from an incorrect handling of data structures associated with ultra performance keys, a feature used to manage power and thermal profiles on specific Dell devices. The root cause lies in a misunderstanding of how event data is structured when passed into the processing function dell_wmi_process_key(). According to the logic established in commit 5fbd827eb9c2, which introduced support for new switches including this ultra performance key, the input buffer provided to the handler has already been parsed such that it starts immediately after the initial type and code fields. However, the original implementation failed to account for this offset correctly when accessing subsequent data fields within the event payload.
This misalignment results in a potential buffer overread condition where the driver attempts to read memory locations beyond the intended boundaries of the valid event data. In C-based kernel programming, such off-by-one or incorrect indexing errors can lead to reading uninitialized memory or sensitive information from adjacent structures in the kernel heap. While the immediate impact might be limited by the specific context of hardware key events which are generally controlled inputs, buffer overreads represent a significant class of vulnerabilities that can potentially be exploited for information disclosure if an attacker can influence the surrounding memory layout through other means. The flaw essentially allows the driver to access data outside its allocated scope, violating basic principles of safe memory management and boundary checking.
From a classification perspective, this vulnerability aligns with CWE-125, which describes Out-of-bounds Read vulnerabilities where software reads past the end or before the beginning of the intended buffer. In terms of attack vectors, while direct exploitation via WMI events is complex due to hardware dependencies, such memory safety issues are often precursors to more severe exploits if combined with other kernel weaknesses. The ATT&CK framework categorizes similar behaviors under techniques involving unauthorized access to system resources or potential data exfiltration through improper memory handling, although the primary risk here remains stability and integrity rather than direct remote code execution without additional context.
The resolution involves correcting the index used to access the first data field within the event buffer, ensuring that the driver respects the pre-parsed structure of the incoming WMI events. By adjusting the pointer arithmetic or array indexing to start at the correct offset after the type and code fields, the driver avoids reading invalid memory regions. This fix ensures that only valid, expected data is processed by the dell_wmi_process_key function. For system administrators and users, applying this kernel update mitigates the risk of potential information leaks caused by uninitialized memory reads during ultra performance key events. It also enhances overall system stability by preventing undefined behavior that could lead to crashes or unpredictable driver states when interacting with Dell hardware features.