CVE-2026-53022
In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: bound enumeration string aggregation populate_enum_data() aggregates firmware-provided value-modifier and possible-value strings into fixed 512-byte struct members. The current code bounds each individual source string but then appends every string and separator with raw strcat() and no remaining-space check. Switch the aggregation loops to a bounded append helper and reject enumeration packages whose combined strings do not fit in the destination buffers. [ij: add include]
Affected versions
Linux kernel versions
5.11
and later are affected. Fixed in
5.15.209,
6.1.175,
6.6.141,
6.12.91,
6.18.33,
7.0.10,
7.1
and their respective stable series.
References
7 totalFrequently asked questions
-
What is CVE-2026-53022?
CVE-2026-53022 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.11 onward and has been patched in 5.15.209, 6.1.175, 6.6.141 and others. CVE-2026-53022 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-53022?
Yes — CVE-2026-53022 has been patched. Fixed versions include 5.15.209, 6.1.175, 6.6.141 and others. If you are running Linux kernel 5.11 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-53022 actively exploited?
No — CVE-2026-53022 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.