CVE-2026-81012: platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: hp-bioscfg: fix off-by-one write in hpgetstringfrombuffer()
hpgetstringfrombuffer() clamps the converted string length against the destination buffer size with "size > dstsize", so when the converted length is exactly equal to dstsize, convdstsize is left at dstsize and the unconditional NUL terminator write
dst[convdstsize] = 0;
lands one byte past the destination buffer. This is the same shape of bug as the previously fixed off-by-one in hpconverthexstrtostr(): the buffer is sized correctly for the content, but the terminator write is never checked against that size.
Fix by changing the comparison to ">=" so convdstsize is always left with room for the terminator.
All fixed-size destinations that reach this function (path[512], currentvalue[512], currentpassword/currentvalue[64], and the per-entry buffers in encodings[][512] and prerequisites[][512]) are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the off-by-one write in hp_get_string_from_buffer() by changing the destination size comparison to ">=" so conv_dst_size is always left within the destination buffer when the converted length equals dst_size.
Linux kernel hp_get_string_from_buffer() comparison for destination size = >=
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel hp-bioscfg platform/x86 driver are exposed when hp_get_string_from_buffer() processes converted input whose length exactly matches a fixed-size destination buffer. The affected destinations include 512-byte path, current_value, encodings, and prerequisites buffers, plus 64-byte current_password/current_value buffers.
What input condition is required to trigger the overwrite?
The converted string length must be exactly equal to the destination buffer size. In that case, the function writes the NUL terminator one byte beyond the end of the destination buffer.
How can I determine whether a system has the fix?
Check whether the installed kernel includes the hp-bioscfg change that replaces the length comparison "size > dst_size" with "size >= dst_size" in hp_get_string_from_buffer(). The provided stable references identify commits containing the fix.