High 7.8Published Jul 25, 2025

CVE-2025-38412platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks

Updated under an hour ago (Oct 26, 2026, 10:40 PM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks After retrieving WMI data blocks in sysfs callbacks, check for the validity of them before dereferencing their content.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from e8a60aa7404bfef37705da5607c97737073ac38d before 92c2d914b5337431d885597a79a3a3d9d55e80b7; from e8a60aa7404bfef37705da5607c97737073ac38d before 68e9963583d11963ceca5d276e9c44684509f759; from e8a60aa7404bfef37705da5607c97737073ac38d before 0deb3eb78ebf225cb41aa9b2b2150f46cbfd359e; from e8a60aa7404bfef37705da5607c97737073ac38d before 5df3b870bc389a1767c72448a3ce1c576ef4deab; from e8a60aa7404bfef37705da5607c97737073ac38d before aaf847dcb4114fe8b25d4c1c790bedcb6088cb3d; from e8a60aa7404bfef37705da5607c97737073ac38d before eb617dd25ca176f3fee24f873f0fd60010773d67	CNA record
linux linux_kernel linux:linux_kernel	from 5.11 before 5.15.187; from 5.16 before 6.1.144; from 6.2 before 6.6.97; from 6.7 before 6.12.37; from 6.13 before 6.15.6; 6.16; 6.16; 6.16; and 1 more ranges	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

References

https://git.kernel.org/stable/c/92c2d914b5337431d885597a79a3a3d9d55e80b7	patch
https://git.kernel.org/stable/c/68e9963583d11963ceca5d276e9c44684509f759	patch
https://git.kernel.org/stable/c/0deb3eb78ebf225cb41aa9b2b2150f46cbfd359e	patch
https://git.kernel.org/stable/c/5df3b870bc389a1767c72448a3ce1c576ef4deab	patch
https://git.kernel.org/stable/c/aaf847dcb4114fe8b25d4c1c790bedcb6088cb3d	patch
https://git.kernel.org/stable/c/eb617dd25ca176f3fee24f873f0fd60010773d67	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	mailing-list, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.