CVE-2026-23370

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23370
In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data set_new_password() hex dumps the entire buffer, which contains plaintext password data, including current and new passwords. Remove the hex dump to avoid leaking credentials.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0e6115c2f2facaed9593c16ad2e5accd487f5c52 Patch
https://git.kernel.org/stable/c/411ba3cd837f7825c0e648e155bc505641f95854 Patch
https://git.kernel.org/stable/c/5de34126fb2edf8ab7f25d677b132e92d8bf9ede Patch
https://git.kernel.org/stable/c/9bbb420f202834363e1e25435e49db0a385c2232 Patch
https://git.kernel.org/stable/c/d1a196e0a6dcddd03748468a0e9e3100790fc85c Patch
https://git.kernel.org/stable/c/d78e74adc5cfff7afd9d03b9da8058a7e435f9bc Patch
https://git.kernel.org/stable/c/d9e785bd62d2ac23cf29a75dcfea8c8087fd3870 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.11:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
History

24 Apr 2026, 16:37

Type Values Removed Values Added
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.11:-:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/0e6115c2f2facaed9593c16ad2e5accd487f5c52 - () https://git.kernel.org/stable/c/0e6115c2f2facaed9593c16ad2e5accd487f5c52 - Patch
References () https://git.kernel.org/stable/c/411ba3cd837f7825c0e648e155bc505641f95854 - () https://git.kernel.org/stable/c/411ba3cd837f7825c0e648e155bc505641f95854 - Patch
References () https://git.kernel.org/stable/c/5de34126fb2edf8ab7f25d677b132e92d8bf9ede - () https://git.kernel.org/stable/c/5de34126fb2edf8ab7f25d677b132e92d8bf9ede - Patch
References () https://git.kernel.org/stable/c/9bbb420f202834363e1e25435e49db0a385c2232 - () https://git.kernel.org/stable/c/9bbb420f202834363e1e25435e49db0a385c2232 - Patch
References () https://git.kernel.org/stable/c/d1a196e0a6dcddd03748468a0e9e3100790fc85c - () https://git.kernel.org/stable/c/d1a196e0a6dcddd03748468a0e9e3100790fc85c - Patch
References () https://git.kernel.org/stable/c/d78e74adc5cfff7afd9d03b9da8058a7e435f9bc - () https://git.kernel.org/stable/c/d78e74adc5cfff7afd9d03b9da8058a7e435f9bc - Patch
References () https://git.kernel.org/stable/c/d9e785bd62d2ac23cf29a75dcfea8c8087fd3870 - () https://git.kernel.org/stable/c/d9e785bd62d2ac23cf29a75dcfea8c8087fd3870 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux
Linux linux Kernel

18 Apr 2026, 09:16

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: platform/x86: dell-wmi-sysman: No volcar en hexadecimal datos de contraseña en texto plano set_new_password() vuelca en hexadecimal el búfer completo, que contiene datos de contraseña en texto plano, incluyendo contraseñas actuales y nuevas. Eliminar el volcado en hexadecimal para evitar la fuga de credenciales.
References
  • () https://git.kernel.org/stable/c/9bbb420f202834363e1e25435e49db0a385c2232 -

25 Mar 2026, 11:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-25 11:16

Updated : 2026-04-24 16:37

NVD link : CVE-2026-23370

Mitre link : CVE-2026-23370

CVE.ORG link : CVE-2026-23370

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo