dell-privacy MicMute Race

Vulnerability analysis

A race condition exists in the Dell privacy WMI driver where a function retrieves a shared device-data object from a linked list, releases the protecting lock, and then dereferences the object to read a feature flag. Between the lock release and the dereference, another thread can remove and free that object during device teardown, resulting in a use-after-free. The fix changes the locking so the mutex is held for the entire duration of the access, preventing the object from being freed until after the read completes. The vulnerable path is reachable locally on Dell hardware equipped with privacy features; the WMI event side is triggered by hardware key presses, while the teardown side involves device lifecycle operations.