Description
In the Linux kernel, the following vulnerability has been resolved:

platform/x86: hp-bioscfg: fix heap OOB read on empty password write

validate_password_input() computes length = strlen(buf) and then
checks buf[length - 1] to strip a trailing newline, without checking
that length is nonzero first. Writing an empty string (a bare '\n')
to current_password or new_password gives length == 0, and
buf[length - 1] reads buf[-1], one byte before the heap allocation
holding the copied input.

KASAN confirms this directly:

BUG: KASAN: slab-out-of-bounds in store_password_instance.constprop.0+0x223/0x2a0 [hp_bioscfg]
Read of size 1 at addr ffff88811bd8da9f by task sh/13740
...
store_password_instance.constprop.0+0x223/0x2a0 [hp_bioscfg]
current_password_store+0x14/0x20 [hp_bioscfg]
...
The buggy address is located 23 bytes to the right of
allocated 8-byte region [ffff88811bd8da80, ffff88811bd8da88)

Reproduced identically via new_password_store. Execution continues
past the bad read (the garbage byte only affects whether "length" is
decremented by one), so the write completes and returns success; this
is a pure information read past the buffer, not a crash, but it is
still an out-of-bounds access KASAN correctly flags.

Fix by only checking buf[length - 1] when length is nonzero.
Published: 2026-09-11
Score: 4.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure via Out-of-Bounds Read
Action: Patch Kernel
AI Analysis

Impact

The hp‑bioscfg driver in the Linux x86 password the last character without verifying the string is non‑empty. When a password value consists only of a newline or is empty, the code reads from buf[-1], producing a heap out‑of‑bounds read that can expose adjacent memory contents. The error does not crash the kernel or alter its state; it simply leaks a single byte that may contain sensitive data. This constitutes a pure information leakage vulnerability rather than a denial‑of‑service or remote execution flaw.

Affected Systems

Any Linux distribution that ships a kernel containing the unpatched hp‑bioscfg module is affected. The vulnerability is present in the generic the universal CPE and vendor, before the patch are vulnerable.

Risk and Exploitability

The CVSS base score of 4.7 reflects moderate severity. The EPSS score of 0.18% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need local access to trigger the password write path, such as via a privileged process or BIOS interface that uses the module. While the anomaly can be detected by tools like KASAN, it is silent in normal operation, making it harder to identify on production systems.

Generated by OpenCVE AI on September 13, 2026 at 03:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that includes the hp‑bioscfg null‑check patch or apply the upstream commit that introduced the check.
  • If the hp‑bioscfg module is not required for BIOS configuration, unload or blacklist it to remove exposure.
  • Avoid submitting empty or newline‑only passwords through the hp‑bioscfg interface; validate input locally to ensure it is non‑empty before usage.

Generated by OpenCVE AI on September 13, 2026 at 03:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H'}

threat_severity

Moderate

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validate_password_input() computes length = strlen(buf) and then checks buf[length - 1] to strip a trailing newline, without checking that length is nonzero first. Writing an empty string (a bare '\n') to current_password or new_password gives length == 0, and buf[length - 1] reads buf[-1], one byte before the heap allocation holding the copied input. KASAN confirms this directly: BUG: KASAN: slab-out-of-bounds in store_password_instance.constprop.0+0x223/0x2a0 [hp_bioscfg] Read of size 1 at addr ffff88811bd8da9f by task sh/13740 ... store_password_instance.constprop.0+0x223/0x2a0 [hp_bioscfg] current_password_store+0x14/0x20 [hp_bioscfg] ... The buggy address is located 23 bytes to the right of allocated 8-byte region [ffff88811bd8da80, ffff88811bd8da88) Reproduced identically via new_password_store. Execution continues past the bad read (the garbage byte only affects whether "length" is decremented by one), so the write completes and returns success; this is a pure information read past the buffer, not a crash, but it is still an out-of-bounds access KASAN correctly flags. Fix by only checking buf[length - 1] when length is nonzero.
Title platform/x86: hp-bioscfg: fix heap OOB read on empty password write
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-11T19:43:02.741Z

Reserved: 2026-08-26T14:34:25.813Z

Link: CVE-2026-81013

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:19:10.173

Modified: 2026-09-11T20:19:10.173

Link: CVE-2026-81013

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:02Z

Links: CVE-2026-81013 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-13T04:00:08Z

Weaknesses