HIGH Introduced in 5.14
dell-privacy MicMute Race
CVE-2026-93131
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-privacy: Fix race condition Accessing priv->features_present needs to happen with the list mutex being held, otherwise priv can be freed at any moment.
02KernelScan AI Analysis
Risk summary
A race condition in the Dell hardware privacy WMI driver allows a shared data object to be accessed after it has been freed, leading to a use-after-free. Any local user on affected Dell hardware could potentially trigger this, and successful exploitation may result in kernel memory corruption, privilege escalation, or a system crash. The vulnerability is limited to systems running this specific Dell platform driver on physical Dell hardware.
Vulnerability analysis
A race condition exists in the Dell privacy WMI driver where a function retrieves a shared device-data object from a linked list, releases the protecting lock, and then dereferences the object to read a feature flag. Between the lock release and the dereference, another thread can remove and free that object during device teardown, resulting in a use-after-free. The fix changes the locking so the mutex is held for the entire duration of the access, preventing the object from being freed until after the read completes. The vulnerable path is reachable locally on Dell hardware equipped with privacy features; the WMI event side is triggered by hardware key presses, while the teardown side involves device lifecycle operations.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.14 | 5.15.221 | 239ae86b7c97 |
| 6.1 | 5.14 | 6.1.188 | 2d2108685a49 |
| 6.6 | 5.14 | 6.6.157 | a22beeb90475 |
| 6.18 | 5.14 | 6.18.52 | 9f860050c3d1 |
| mainline | 5.14 | 7.3-rc1 | ca9338dbc647 |
| 7.2 | 5.14 | 7.2.6 | ef59ff891adf |
| 6.12 | 5.14 | 6.12.110 | f3c4532f6dac |
| cip/6.12 | 5.14 | 6.12.111-cip32 | f3c4532f6dac |