CVE-2026-81012

The Linux kernel's HP BIOS configuration driver (platform/x86 hp-bioscfg) contains an off-by-one heap buffer overflow in hp_get_string_from_buffer(): when a string converted from BIOS-held data is exactly as long as the destination buffer, the unconditional NUL-terminator write lands one byte past the end of fixed-size buffers such as path[512], current_value[512], current_password/current_value[64], and the per-entry encodings[][512] and prerequisites[][512] arrays. The flaw sits on the local firmware-attributes code path, so an attacker with unprivileged local access on an affected HP machine can plausibly trigger a one-byte zero write past a kernel heap buffer, corrupting adjacent memory with potential for privilege escalation or a crash/DoS — reflected in the high CVSS 8.4 rating with full confidentiality, integrity and availability impact. Affected systems are HP laptops and desktops running Linux kernels that ship the hp-bioscfg driver, which only loads on HP hardware. No public proof of concept is known, the issue is not in CISA's KEV catalog, and exploitation in the wild is presumed absent.

What to do: Apply kernel updates containing the fix (the size clamp in hp_get_string_from_buffer() changed from '>' to '>=') as soon as your distribution ships a backport, and reboot into the patched kernel. In the interim, minimize unprivileged local accounts on HP Linux systems and monitor for unexpected reads/writes under /sys/class/firmware-attributes/ on HP hardware. There is no clean configuration-only workaround, since the overflow occurs while parsing BIOS-provided strings.