Executive brief
A vulnerability in the Linux kernel's HP BIOS configuration driver could allow a local user to cause a system crash or potentially access sensitive kernel memory. The issue occurs when the system processes specific hardware configuration data (ACPI packages) related to BIOS settings on HP devices. This could impact the stability of the operating system or lead to unauthorized information disclosure.
Technical details
Out-of-bounds read vulnerabilities exist in the hp_populate_*_elements_from_package() functions within the hp-bioscfg driver (drivers/platform/x86/hp/hp-bioscfg/). The root cause is insufficient bounds checking when iterating through ACPI objects; while the base index 'elem' was validated, the driver failed to account for additional offsets ('reqs' or 'pos_values') used when processing multi-element fields like PREREQUISITES and ENUM_POSSIBLE_VALUES. A local attacker with low privileges could exploit this to read beyond allocated array boundaries in kernel space. Patches have been released for various stable kernel branches including 6.6.y, 6.12.y, and 6.18.y.
Affected products
- Linux Linux Kernel 6.6 to 6.6.120, 6.7 to 6.12.64, 6.13 to 6.18.4
Timeline
- 2025-12-26: patched: Initial fix commit authored
- 2026-01-08: patched: Commited to stable tree
- 2026-01-13: advisory: CVE published