CVE-2026-93129

What it actually does

Potential buffer overread in dell-wmi-base driver when processing ultra performance key events due to incorrect index into already-parsed event buffer in dell_wmi_process_key().

Why it matters to the business

May cause kernel instability, crashes, or limited information disclosure on Dell systems exposing the ultra performance key path; low likelihood given stable low EPSS and absence from KEV.

How an attack unfolds

An attacker with the ability to synthesize or replay a WMI ultra performance key event supplies data that reaches the misindexed access, resulting in a read beyond the intended buffer bounds; no named threat actors or ransomware campaigns are associated.

How to fix it

Update to a Linux kernel containing the fix for commit 5fbd827eb9c2 that uses the correct index for the first data field after the type and code fields.

How to confirm the fix worked

Confirm the corrected index calculation is present in platform/x86/dell-wmi-base.c and that no buffer-overread path remains for ultra performance keys.

Typical attack path

1. Obtain or synthesize a WMI event containing an ultra performance key with additional data fields
2. Deliver the event to the dell-wmi-base handler
3. Trigger dell_wmi_process_key() with the incorrectly indexed buffer access
4. Observe kernel memory overread effects

How to detect it

Inspect kernel logs and dmesg for oops/panic entries referencing dell_wmi or dell_wmi_base when performance keys are pressed; no remote network indicators exist.

What your security team should do

• Apply upstream or distribution kernel updates addressing the dell-wmi-base ultra performance key handling
• Prioritize systems with Dell hardware that expose performance-mode keys
• Monitor kernel logs for oops related to dell_wmi after updates