CVE-2026-23131: platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names
The hp-bioscfg driver attempts to register kobjects with empty names when the HP BIOS returns attributes with empty name strings. This causes multiple kernel warnings:
kobject: (00000000135fb5e6): attempted to be registered with empty name! WARNING: CPU: 14 PID: 3336 at lib/kobject.c:219 kobjectaddinternal+0x2eb/0x310
Add validation in hpinitbiosbufferattribute() to check if the attribute name is empty after parsing it from the WMI buffer. If empty, log a debug message and skip registration of that attribute, allowing the module to continue processing other valid attributes.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel with the hp-bioscfg driver are affected when the HP BIOS provides an attribute whose name is an empty string. The issue occurs while the driver processes BIOS attributes obtained through its WMI buffer.
What access does an attacker need to trigger the issue?
The supplied CVSS vector rates the issue as local, low complexity, and requiring low privileges, with no user interaction. The described trigger is an HP BIOS attribute with an empty name.
What is the impact of successful triggering?
Registering a kobject with an empty name produces kernel warnings. The CVSS vector indicates a high availability impact, with no confidentiality or integrity impact.
What should be done if the system cannot be patched immediately?
The provided data identifies a patch as available but does not specify a workaround. The patch changes the driver to skip BIOS attributes with empty names while continuing to process valid attributes.
How can I identify whether the issue has occurred?
Look for kernel warnings stating that a kobject was attempted to be registered with an empty name, including messages from kobject_add_internal. These warnings can occur when hp-bioscfg processes an empty attribute name returned by the HP BIOS.