Linux Kernel dell-laptop CVE-2026-72144

Exploitation requires local, low-privileged code execution on a physical Dell laptop or workstation running an affected Linux kernel version (2.6.37 through the pre-fix commits in 6.6.x, 6.12.x, 6.18.x, 7.1.x, or 7.2-rc1). The dell-laptop kernel module must be loaded, which occurs automatically on Dell hardware when udev loads platform drivers. The vulnerable condition is reached specifically when the dell_init() function encounters a failure after rfkill setup but before all subsequent resource registrations complete - this is an error-path condition, not the normal execution path, so triggering it may require additional preconditions such as resource exhaustion or hardware state manipulation. Exploitation is limited to systems with Dell hardware (the module is hardware-specific), requires existing local access (eliminating remote-only threat actors), and depends on the ability to interact with the orphaned kernel objects post-failure. Authentication at OS level is required - unauthenticated remote exploitation is not possible given AV:L in the CVSS vector.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a score of 7.8 High, but several signals argue for treating this as lower operational urgency than that score implies. The attack vector is strictly local (AV:L), requiring an attacker who already has a low-privilege shell on a physical Dell laptop running a vulnerable kernel - a significant prerequisite that reduces the exposed attack surface considerably. The EPSS score of 0.20% at the 10th percentile indicates that the broader security community assesses exploitation as very unlikely in practice; this aligns with the fact that triggering the specific init-failure code path is not trivial under normal operating conditions. There is no CISA KEV listing and no public exploit code identified at time of analysis. The C:H/I:H/A:H impact triple is the ceiling assuming successful exploitation of the dangling kernel objects for privilege escalation, not a guaranteed outcome of every triggered cleanup failure - the actual exploitability path from incomplete cleanup to a controlled privilege escalation requires chaining additional conditions. Defenders should prioritize the patch on managed Dell laptop fleets but need not treat this as an emergency comparable to remotely exploitable or actively exploited kernel CVEs.

A local low-privileged attacker on a Dell laptop running a vulnerable kernel could trigger the dell-laptop module to enter a failed initialization state - for example by manipulating hardware resource availability or loading the module under constrained conditions - causing the incomplete cleanup to leave dangling kernel object registrations. The attacker could then interact with the orphaned sysfs nodes or notifier chain entries to achieve a use-after-free condition, potentially escalating privileges to root. No public exploit code has been identified at time of analysis, and the specific primitive chain from cleanup failure to controlled privilege escalation has not been publicly demonstrated.