Executive brief
The Linux kernel's HP BIOS configuration driver contains a memory read vulnerability in its password handling code. When an empty password (newline only) is written to password fields, the code reads one byte before the allocated buffer, potentially exposing sensitive information from adjacent memory. This affects HP systems where BIOS settings are managed through the kernel driver.
Technical details
The vulnerability is a heap out-of-bounds read in the validate_password_input() function within the hp-bioscfg driver. The function computes length = strlen(buf) and immediately accesses buf[length - 1] to check for a trailing newline, without first verifying that length is nonzero. Writing an empty string (just '\n') results in length == 0, causing buf[-1] to read one byte before the heap allocation. The attack vector is local, requiring write access to sysfs password attributes (current_password or new_password). Exploitation does not cause a crash but leaks one garbage byte from heap memory; the operation completes successfully. The fix adds a length > 0 check before accessing buf[length - 1].
Affected products
- Linux Linux kernel 5.0 and later through 6.9 (affects hp-bioscfg driver module)
Timeline
- 2026-09-11: disclosed
- 2026-09-07: patched: upstream fix merged