Linux Kernel up to 7.2.5 dell-wmi-base dell_wmi_process_key buffer overflow

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 7.2.5. The affected element is the function dell_wmi_process_key of the component dell-wmi-base. This manipulation causes buffer overflow. The identification of this vulnerability is CVE-2026-93129. The attack can only be executed locally. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.2.5. It has been declared as problematic. Affected by this vulnerability is the function dell_wmi_process_key of the component dell-wmi-base. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-base: Fix handling of ultra performance key The commit message of commit 5fbd827eb9c2 ("platform/x86: dell-wmi: Recognise or support new switches") states that the ultra performance key contains additional data after the type and code fields. The event data passed to dell_wmi_process_key() is already parsed, so "buffer" already starts after those two fields. Use the correct index for accessing the first data field to avoid a potential buffer overread.

The advisory is shared at git.kernel.org. This vulnerability is known as CVE-2026-93129 since 09/17/2026. The exploitation appears to be easy. An attack has to be approached locally. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/17/2026).

Upgrading to version 7.2.6 or 7.3-rc1 eliminates this vulnerability. Applying the patch 392c19faec6bf4cb72fb02322e2a61e198dd8f72/adfd6846bea13667ff28f8aaf00c32fbd69825ab is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion