{"api_version":"1","generated_at":"2026-09-27T09:45:20+00:00","cve":"CVE-2026-81011","urls":{"html":"https://cve.report/CVE-2026-81011","api":"https://cve.report/api/cve/CVE-2026-81011.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-81011","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-81011"},"summary":{"title":"platform/x86: hp-bioscfg: pass validated element count to package parsers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: hp-bioscfg: pass validated element count to package parsers\n\nThe per-type package parsers are handed the wrong element count.\n\nhp_init_bios_package_attribute() validates obj->package.count and then\ncalls one of the five hp_populate_*_package_data() wrappers (string,\ninteger, enumeration, ordered list, password). Each wrapper forwards a\ncount to its hp_populate_*_elements_from_package() parser, but instead\nof forwarding the validated obj->package.count it derives the count\nfrom elements[0]. elements[0] is the NAME field and is always an\nACPI_TYPE_STRING, so reading ->package.count from it in fact reads\n->string.length through the union acpi_object. The parsers thus bound\nthemselves against the length of the name string rather than against\nthe real number of elements in the package.\n\nThis is safe today because hp_init_bios_package_attribute() refuses any\npackage that has fewer than the type's element count, so a parser only\never runs on a full package and never reads past it regardless of the\nbogus bound.\n\nAn upcoming change relaxes that check to accept shorter packages. Once\na parser can receive fewer elements than its per-type count, a bound\ntaken from the name length no longer reflects the array size, and the\n\"elem < count\" loop conditions and \"elem + n >= count\" sub-loop guards\nread past the end of elements[] - an out-of-bounds heap read.\n\nForward the validated obj->package.count to every *_package_data()\nwrapper so the parsers bound themselves against the real package size.\nThis does not change behaviour for the packages that enumerate\ncorrectly today and is a prerequisite for accepting shorter packages\nsafely.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-11 20:19:09","updated_at":"2026-09-14 13:18:55"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","data":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/436017808c7cbcdb5e49b2142090d4391e3de9a6","name":"https://git.kernel.org/stable/c/436017808c7cbcdb5e49b2142090d4391e3de9a6","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e0ddfd77c0c320b7d12b6c9169303b140b798775","name":"https://git.kernel.org/stable/c/e0ddfd77c0c320b7d12b6c9169303b140b798775","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/400cbc3ccc88a5ad37cd85056224635ce9eba018","name":"https://git.kernel.org/stable/c/400cbc3ccc88a5ad37cd85056224635ce9eba018","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/467e53f231f77a1677191b8cdabdaf1448439d55","name":"https://git.kernel.org/stable/c/467e53f231f77a1677191b8cdabdaf1448439d55","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a38127df99ae8b1851560b35b837c9952416143a","name":"https://git.kernel.org/stable/c/a38127df99ae8b1851560b35b837c9952416143a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81011","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81011","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a34fc329b1895fc8a6eb12099adc47009421ba6a 467e53f231f77a1677191b8cdabdaf1448439d55 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a34fc329b1895fc8a6eb12099adc47009421ba6a 436017808c7cbcdb5e49b2142090d4391e3de9a6 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a34fc329b1895fc8a6eb12099adc47009421ba6a a38127df99ae8b1851560b35b837c9952416143a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a34fc329b1895fc8a6eb12099adc47009421ba6a 400cbc3ccc88a5ad37cd85056224635ce9eba018 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a34fc329b1895fc8a6eb12099adc47009421ba6a e0ddfd77c0c320b7d12b6c9169303b140b798775 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.6","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.157 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.109 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.50 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.4 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"81011","cve":"CVE-2026-81011","epss":"0.001250000","percentile":"0.025160000","score_date":"2026-09-14","updated_at":"2026-09-15 00:00:42"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/platform/x86/hp/hp-bioscfg/bioscfg.c","drivers/platform/x86/hp/hp-bioscfg/bioscfg.h","drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c","drivers/platform/x86/hp/hp-bioscfg/int-attributes.c","drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c","drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c","drivers/platform/x86/hp/hp-bioscfg/string-attributes.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"467e53f231f77a1677191b8cdabdaf1448439d55","status":"affected","version":"a34fc329b1895fc8a6eb12099adc47009421ba6a","versionType":"git"},{"lessThan":"436017808c7cbcdb5e49b2142090d4391e3de9a6","status":"affected","version":"a34fc329b1895fc8a6eb12099adc47009421ba6a","versionType":"git"},{"lessThan":"a38127df99ae8b1851560b35b837c9952416143a","status":"affected","version":"a34fc329b1895fc8a6eb12099adc47009421ba6a","versionType":"git"},{"lessThan":"400cbc3ccc88a5ad37cd85056224635ce9eba018","status":"affected","version":"a34fc329b1895fc8a6eb12099adc47009421ba6a","versionType":"git"},{"lessThan":"e0ddfd77c0c320b7d12b6c9169303b140b798775","status":"affected","version":"a34fc329b1895fc8a6eb12099adc47009421ba6a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/platform/x86/hp/hp-bioscfg/bioscfg.c","drivers/platform/x86/hp/hp-bioscfg/bioscfg.h","drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c","drivers/platform/x86/hp/hp-bioscfg/int-attributes.c","drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c","drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c","drivers/platform/x86/hp/hp-bioscfg/string-attributes.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.157","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.109","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.50","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.157","versionStartIncluding":"6.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.109","versionStartIncluding":"6.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.50","versionStartIncluding":"6.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.4","versionStartIncluding":"6.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"6.6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: hp-bioscfg: pass validated element count to package parsers\n\nThe per-type package parsers are handed the wrong element count.\n\nhp_init_bios_package_attribute() validates obj->package.count and then\ncalls one of the five hp_populate_*_package_data() wrappers (string,\ninteger, enumeration, ordered list, password). Each wrapper forwards a\ncount to its hp_populate_*_elements_from_package() parser, but instead\nof forwarding the validated obj->package.count it derives the count\nfrom elements[0]. elements[0] is the NAME field and is always an\nACPI_TYPE_STRING, so reading ->package.count from it in fact reads\n->string.length through the union acpi_object. The parsers thus bound\nthemselves against the length of the name string rather than against\nthe real number of elements in the package.\n\nThis is safe today because hp_init_bios_package_attribute() refuses any\npackage that has fewer than the type's element count, so a parser only\never runs on a full package and never reads past it regardless of the\nbogus bound.\n\nAn upcoming change relaxes that check to accept shorter packages. Once\na parser can receive fewer elements than its per-type count, a bound\ntaken from the name length no longer reflects the array size, and the\n\"elem < count\" loop conditions and \"elem + n >= count\" sub-loop guards\nread past the end of elements[] - an out-of-bounds heap read.\n\nForward the validated obj->package.count to every *_package_data()\nwrapper so the parsers bound themselves against the real package size.\nThis does not change behaviour for the packages that enumerate\ncorrectly today and is a prerequisite for accepting shorter packages\nsafely."}],"metrics":[{"cvssV3_1":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The hp-bioscfg package parsers run during local driver initialization on ACPI/WMI objects fetched by wmi_query_block(); there is no network, adjacent-radio, or USB/peripheral path into this code.\nAC:L - A NAME whose string.length exceeds the real package.count makes the nested elem+n bounds and outer elem<count loops walk past elements[] whenever a multi-element field such as PREREQUISITES is present; a crafted or shortened firmware package triggers that over-read deterministically, with no race or attacker-uncontrollable layout.\nPR:L - hp-bioscfg autoloads on HP WMI GUIDs, and parsed fields are copied into world-readable sysfs attributes under firmware-attributes/hp-bioscfg; an ordinary local user can read that metadata, and no capability or user-namespace gate protects the path.\nUI:N - Parsing occurs in hp_init()/hp_init_bios_attributes() on module load or built-in init; exploitation does not require a victim to open a file, mount a filesystem, or take any other action.\nS:U - The out-of-bounds heap read, any resulting kernel-memory disclosure, and any oops remain inside the same kernel security authority; this is not a VM, IOMMU, or sandbox escape.\nC:H - Out-of-bounds union acpi_object slots are treated as STRING objects, so hp_convert_hexstr_to_str() follows an OOB pointer and length and copies the result into sysfs-visible buffers, yielding an unbounded kernel read rather than a few-byte leak.\nI:N - The flaw is an out-of-bounds read; parsed values are stored through bounded strscpy and scalar assignment into fixed-size driver fields, with no OOB write or control-flow hijack primitive.\nA:H - An out-of-bounds descriptor with a bogus string.pointer is dereferenced by hp_convert_hexstr_to_str(), which causes a kernel oops or panic during driver initialization."}]}],"providerMetadata":{"dateUpdated":"2026-09-14T11:59:43.878Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/467e53f231f77a1677191b8cdabdaf1448439d55"},{"url":"https://git.kernel.org/stable/c/436017808c7cbcdb5e49b2142090d4391e3de9a6"},{"url":"https://git.kernel.org/stable/c/a38127df99ae8b1851560b35b837c9952416143a"},{"url":"https://git.kernel.org/stable/c/400cbc3ccc88a5ad37cd85056224635ce9eba018"},{"url":"https://git.kernel.org/stable/c/e0ddfd77c0c320b7d12b6c9169303b140b798775"}],"title":"platform/x86: hp-bioscfg: pass validated element count to package parsers","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-81011","datePublished":"2026-09-11T19:43:01.422Z","dateReserved":"2026-08-26T14:34:25.813Z","dateUpdated":"2026-09-14T11:59:43.878Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-11 20:19:09","lastModifiedDate":"2026-09-14 13:18:55","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"81011","Ordinal":"1","Title":"platform/x86: hp-bioscfg: pass validated element count to packag","CVE":"CVE-2026-81011","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"81011","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: hp-bioscfg: pass validated element count to package parsers\n\nThe per-type package parsers are handed the wrong element count.\n\nhp_init_bios_package_attribute() validates obj->package.count and then\ncalls one of the five hp_populate_*_package_data() wrappers (string,\ninteger, enumeration, ordered list, password). Each wrapper forwards a\ncount to its hp_populate_*_elements_from_package() parser, but instead\nof forwarding the validated obj->package.count it derives the count\nfrom elements[0]. elements[0] is the NAME field and is always an\nACPI_TYPE_STRING, so reading ->package.count from it in fact reads\n->string.length through the union acpi_object. The parsers thus bound\nthemselves against the length of the name string rather than against\nthe real number of elements in the package.\n\nThis is safe today because hp_init_bios_package_attribute() refuses any\npackage that has fewer than the type's element count, so a parser only\never runs on a full package and never reads past it regardless of the\nbogus bound.\n\nAn upcoming change relaxes that check to accept shorter packages. Once\na parser can receive fewer elements than its per-type count, a bound\ntaken from the name length no longer reflects the array size, and the\n\"elem < count\" loop conditions and \"elem + n >= count\" sub-loop guards\nread past the end of elements[] - an out-of-bounds heap read.\n\nForward the validated obj->package.count to every *_package_data()\nwrapper so the parsers bound themselves against the real package size.\nThis does not change behaviour for the packages that enumerate\ncorrectly today and is a prerequisite for accepting shorter packages\nsafely.","Type":"Description","Title":"platform/x86: hp-bioscfg: pass validated element count to packag"}]}}}