{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-81011","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-26T14:34:25.813Z","datePublished":"2026-09-11T19:43:01.422Z","dateUpdated":"2026-09-14T11:59:43.878Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-14T11:59:43.878Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: hp-bioscfg: pass validated element count to package parsers\n\nThe per-type package parsers are handed the wrong element count.\n\nhp_init_bios_package_attribute() validates obj->package.count and then\ncalls one of the five hp_populate_*_package_data() wrappers (string,\ninteger, enumeration, ordered list, password). Each wrapper forwards a\ncount to its hp_populate_*_elements_from_package() parser, but instead\nof forwarding the validated obj->package.count it derives the count\nfrom elements[0]. elements[0] is the NAME field and is always an\nACPI_TYPE_STRING, so reading ->package.count from it in fact reads\n->string.length through the union acpi_object. The parsers thus bound\nthemselves against the length of the name string rather than against\nthe real number of elements in the package.\n\nThis is safe today because hp_init_bios_package_attribute() refuses any\npackage that has fewer than the type's element count, so a parser only\never runs on a full package and never reads past it regardless of the\nbogus bound.\n\nAn upcoming change relaxes that check to accept shorter packages. Once\na parser can receive fewer elements than its per-type count, a bound\ntaken from the name length no longer reflects the array size, and the\n\"elem < count\" loop conditions and \"elem + n >= count\" sub-loop guards\nread past the end of elements[] - an out-of-bounds heap read.\n\nForward the validated obj->package.count to every *_package_data()\nwrapper so the parsers bound themselves against the real package size.\nThis does not change behaviour for the packages that enumerate\ncorrectly today and is a prerequisite for accepting shorter packages\nsafely."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The hp-bioscfg package parsers run during local driver initialization on ACPI/WMI objects fetched by wmi_query_block(); there is no network, adjacent-radio, or USB/peripheral path into this code.\nAC:L - A NAME whose string.length exceeds the real package.count makes the nested elem+n bounds and outer elem<count loops walk past elements[] whenever a multi-element field such as PREREQUISITES is present; a crafted or shortened firmware package triggers that over-read deterministically, with no race or attacker-uncontrollable layout.\nPR:L - hp-bioscfg autoloads on HP WMI GUIDs, and parsed fields are copied into world-readable sysfs attributes under firmware-attributes/hp-bioscfg; an ordinary local user can read that metadata, and no capability or user-namespace gate protects the path.\nUI:N - Parsing occurs in hp_init()/hp_init_bios_attributes() on module load or built-in init; exploitation does not require a victim to open a file, mount a filesystem, or take any other action.\nS:U - The out-of-bounds heap read, any resulting kernel-memory disclosure, and any oops remain inside the same kernel security authority; this is not a VM, IOMMU, or sandbox escape.\nC:H - Out-of-bounds union acpi_object slots are treated as STRING objects, so hp_convert_hexstr_to_str() follows an OOB pointer and length and copies the result into sysfs-visible buffers, yielding an unbounded kernel read rather than a few-byte leak.\nI:N - The flaw is an out-of-bounds read; parsed values are stored through bounded strscpy and scalar assignment into fixed-size driver fields, with no OOB write or control-flow hijack primitive.\nA:H - An out-of-bounds descriptor with a bogus string.pointer is dereferenced by hp_convert_hexstr_to_str(), which causes a kernel oops or panic during driver initialization."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/platform/x86/hp/hp-bioscfg/bioscfg.c","drivers/platform/x86/hp/hp-bioscfg/bioscfg.h","drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c","drivers/platform/x86/hp/hp-bioscfg/int-attributes.c","drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c","drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c","drivers/platform/x86/hp/hp-bioscfg/string-attributes.c"],"versions":[{"version":"a34fc329b1895fc8a6eb12099adc47009421ba6a","lessThan":"467e53f231f77a1677191b8cdabdaf1448439d55","status":"affected","versionType":"git"},{"version":"a34fc329b1895fc8a6eb12099adc47009421ba6a","lessThan":"436017808c7cbcdb5e49b2142090d4391e3de9a6","status":"affected","versionType":"git"},{"version":"a34fc329b1895fc8a6eb12099adc47009421ba6a","lessThan":"a38127df99ae8b1851560b35b837c9952416143a","status":"affected","versionType":"git"},{"version":"a34fc329b1895fc8a6eb12099adc47009421ba6a","lessThan":"400cbc3ccc88a5ad37cd85056224635ce9eba018","status":"affected","versionType":"git"},{"version":"a34fc329b1895fc8a6eb12099adc47009421ba6a","lessThan":"e0ddfd77c0c320b7d12b6c9169303b140b798775","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/platform/x86/hp/hp-bioscfg/bioscfg.c","drivers/platform/x86/hp/hp-bioscfg/bioscfg.h","drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c","drivers/platform/x86/hp/hp-bioscfg/int-attributes.c","drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c","drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c","drivers/platform/x86/hp/hp-bioscfg/string-attributes.c"],"versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","status":"unaffected","versionType":"semver"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.12.109"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.18.50"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"7.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"7.3-rc1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/467e53f231f77a1677191b8cdabdaf1448439d55"},{"url":"https://git.kernel.org/stable/c/436017808c7cbcdb5e49b2142090d4391e3de9a6"},{"url":"https://git.kernel.org/stable/c/a38127df99ae8b1851560b35b837c9952416143a"},{"url":"https://git.kernel.org/stable/c/400cbc3ccc88a5ad37cd85056224635ce9eba018"},{"url":"https://git.kernel.org/stable/c/e0ddfd77c0c320b7d12b6c9169303b140b798775"}],"title":"platform/x86: hp-bioscfg: pass validated element count to package parsers","x_generator":{"engine":"bippy-1.2.0"}}}}