CVE-2026-53022 Details
Description
In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: bound enumeration string aggregation populate_enum_data() aggregates firmware-provided value-modifier and possible-value strings into fixed 512-byte struct members. The current code bounds each individual source string but then appends every string and separator with raw strcat() and no remaining-space check. Switch the aggregation loops to a bounded append helper and reject enumeration packages whose combined strings do not fit in the destination buffers. [ij: add include]
A vulnerability exists in the Linux kernel's handling of enumeration data for Dell systems via the WMI interface. The issue arises in the 'populate_enum_data' function, which collects firmware-provided strings into fixed-size struct members. While the code correctly limits the length of individual strings, it fails to check the total length after concatenating these strings and separators, potentially leading to buffer overflows. This vulnerability affects several versions of the Linux kernel.
Users can upgrade to the latest stable version of the Linux kernel where this vulnerability has been addressed. Instructions for downloading the latest kernel version can be found on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/3c34471c26abc52a37f5ad90949e2e4b8027eb14 | kernel.org | Patch |
| https://git.kernel.org/stable/c/5a04f9a36930792f6d64e28d43609e158d09b665 | kernel.org | Patch |
| https://git.kernel.org/stable/c/75c738d4f27fa18a2a033de153bd40302bde6a66 | kernel.org | Patch |
| https://git.kernel.org/stable/c/7b3dc1f764bf24eb99474a5de8173b0b43a8b071 | kernel.org | Patch |
| https://git.kernel.org/stable/c/90b118d264845f7aaf539ac49f7c75f1f29590e2 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ba0843c1955864401295f7ba3b420afe19f2266d | kernel.org | Patch |
| https://git.kernel.org/stable/c/c5683ca4949a514fbe656c6d0d08c4c126e21db9 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.11, < 5.15.209 >= 5.16, < 6.1.175 >= 6.2, < 6.6.141 >= 6.7, < 6.12.91 >= 6.13, < 6.18.33 >= 6.19, < 7.0.10 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | Initial Analysis | [email protected] |
| Jun 24, 2026 | New CVE Received | kernel.org |