Executive brief
The Linux kernel's HP BIOS configuration driver contains an off-by-one error that allows a write one byte past a fixed-size buffer. When processing BIOS strings, the code fails to account for the NUL terminator when clamping output size, enabling memory corruption that could affect system stability or enable local privilege escalation on affected HP systems.
Technical details
The vulnerability is an off-by-one buffer overflow in the hp_get_string_from_buffer() function within the platform/x86 hp-bioscfg driver. The flaw occurs because the boundary check uses "size > dst_size" instead of "size >= dst_size", leaving room for exactly one extra byte—which is then unconditionally written as a NUL terminator at dst[conv_dst_size], landing one byte past the destination buffer. Multiple fixed-size buffers are affected, including path[512], current_value[512], and several 64-byte arrays. The vulnerability requires no authentication and is triggered during normal BIOS configuration operations; a local attacker could cause kernel memory corruption. A patch changing the comparison operator to ">=" reserves space for the terminator.
Affected products
- Linux Linux kernel Affected in platform/x86: hp-bioscfg driver; patched versions include 5.10.x, 5.15.x, 6.x series with the fix applied
Timeline
- 2026-09-11: disclosed: CVE-2026-81012 published
- 2026-09-07: patched: Patch merged into stable kernel trees
- 2026-08-12: other: Fix authored