Executive brief
The Linux kernel's HP BIOS configuration driver contains a heap buffer over-read vulnerability in functions that handle cryptographic key material (signing keys and endorsement keys). When a user writes data to these sysfs interfaces (the normal case with shell echo commands), the driver reads one additional byte beyond the allocated memory, potentially exposing sensitive key data or system memory contents.
Technical details
The vulnerability is a classic heap out-of-bounds read in the hp-bioscfg driver's sk_store() and kek_store() functions. The root cause: these functions strip a trailing newline before allocating a buffer (decrementing the length variable), but then pass the original untrimmed count value to hp_wmi_perform_query(), which performs a memcpy() with that larger size. This reads exactly one byte past the allocated heap region whenever input ends in a newline—the standard case for sysfs writes. The attack vector is local and requires no special privileges (any user can write to sysfs). KASAN confirmed the issue with explicit out-of-bounds read traces. A fix was merged upstream (commit a7508c7959ff8d037327d377ed21a9c0eabe4674) that passes the correct length variable instead of count to the query function.
Affected products
- Linux Linux kernel versions containing the hp-bioscfg driver with the vulnerable sk_store() and kek_store() functions (fixed in upstream commit a7508c7959ff8d037327d377ed21a9c0eabe4674)
Timeline
- 2026-09-11: disclosed: CVE-2026-81014 published
- 2026-09-07: patched: Fix merged to kernel stable tree (commit 4c6374dcb270d12907b880cf82a5a5ef21785fc3)