CVE-2026-89444

What it actually does

The Linux kernel Dell WMI BIOS system-management driver (dell-wmi-sysman) copies the current BIOS administrator password into the security region of a BIOS attribute request buffer in set_attribute(), then hex-dumps the entire buffer with print_hex_dump_bytes(). That discloses the plaintext firmware admin password to anyone who can read the kernel ring buffer or persisted kernel logs. It is a local credential-exposure / information-disclosure flaw, not remote code execution or a standalone privilege-escalation primitive.

Why it matters to the business

On Dell hardware running Linux with this driver, BIOS administrator passwords used to change firmware attributes can leak into dmesg, syslog/journal, crash dumps, and support bundles. Recovered passwords can enable unauthorized firmware changes, weakening of boot-integrity settings, or persistence below the OS. EPSS is very low (~0.002 and flat over 30 days), exploit maturity is none, the issue is not in CISA KEV, and it is not associated with ransomware campaigns—so widespread automated exploitation is unlikely. Residual risk is concentrated on Dell Linux fleets that change password-protected BIOS attributes and then collect or share kernel logs.

How an attack unfolds

A local actor who can read kernel diagnostic output (or who obtains logs, vmcores, or vendor support packages from such a system) waits for an administrator or management tool to update a Dell BIOS attribute through the sysman interface. During that write, set_attribute() fills the security area via populate_security_buffer() and dumps the full request buffer to the kernel log. The attacker extracts the password from the hex dump and reuses it to authenticate later BIOS attribute or password operations. No remote unauthenticated path is described; log access—including world-readable dmesg, overly broad log shipping, or leaked support artifacts—is the enabling condition. No named threat actors are associated with this CVE.

How to fix it

Install a Linux kernel that includes the dell-wmi-sysman fix removing the remaining print_hex_dump_bytes() of the BIOS attribute request buffer in set_attribute() (companion to the earlier password-path dump removal). Until patched, avoid changing password-protected BIOS attributes on affected Dell Linux systems, restrict kernel-log access (kernel.dmesg_restrict, tight journal/syslog permissions), and treat any BIOS admin password used with this driver as exposed—rotate it from a trusted firmware setup path that does not log the secret. Purge or tightly control support bundles, vmcores, and log archives that may contain the dump. Exact distro package versions were not supplied with this record; take the vendor/distro kernel that advertises this fix.

How to confirm the fix worked

Confirm platform/x86 dell-wmi-sysman (set_attribute) no longer hex-dumps the attribute request/security buffer in the running kernel’s changelog or source. After patching, BIOS attribute updates must not emit a hex dump of the password region in kernel logs. Inventory Dell Linux systems that load dell-wmi-sysman and verify dmesg/journal access is restricted. Search historical kernel logs and support artifacts for hex dumps adjacent to this driver to see whether passwords were previously exposed.

Typical attack path

1. Gain local access to a Dell Linux system that loads dell-wmi-sysman, or obtain kernel logs, crash dumps, or support bundles from such a system.
2. Wait for (or observe) a password-protected BIOS attribute change that invokes set_attribute() with the admin password in the security buffer.
3. Read kernel logs (dmesg, journalctl -k, kern.log/messages, or SIEM-ingested kernel messages) for the hex dump of the request buffer.
4. Decode the hex dump to recover the plaintext BIOS administrator password.
5. Reuse the password to change BIOS/firmware attributes or related firmware security settings.

How to detect it

This flaw leaks credentials into logs rather than installing malware, so look for evidence of exposure and password reuse, not a dropper. Review historical kernel logs (journalctl -k, /var/log/kern.log, /var/log/messages, dmesg snapshots), kdump/vmcore, and vendor support bundles on Dell Linux systems around BIOS attribute changes. Search for hex dumps emitted while dell-wmi-sysman handled attribute writes, then correlate with later unexpected firmware setting changes. There are no public KEV, ransomware, or named-actor campaigns for this issue; prioritize local log access and post-dump password reuse.

• dell-wmi-sysman
• dell_wmi_sysman
• firmware-attributes/dell-wmi-sysman

What your security team should do

• Patch Linux kernels on Dell systems that load dell-wmi-sysman even though EPSS is low and the CVE is not in KEV.
• Rotate BIOS/firmware administrator passwords on systems that changed password-protected attributes while unpatched.
• Enable kernel.dmesg_restrict and restrict access to journald, syslog, kern logs, kdump/vmcore, and vendor support bundles.
• Hunt historical kernel logs and support artifacts for hex dumps of BIOS attribute request buffers from this driver.
• Review log-forwarding pipelines so kernel hex dumps cannot land in broadly readable SIEM indexes or ticket attachments.