CVE-2026-81012: platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: hp-bioscfg: fix off-by-one write in hpgetstringfrombuffer()
hpgetstringfrombuffer() clamps the converted string length against the destination buffer size with "size > dstsize", so when the converted length is exactly equal to dstsize, convdstsize is left at dstsize and the unconditional NUL terminator write
dst[convdstsize] = 0;
lands one byte past the destination buffer. This is the same shape of bug as the previously fixed off-by-one in hpconverthexstrtostr(): the buffer is sized correctly for the content, but the terminator write is never checked against that size.
Fix by changing the comparison to ">=" so convdstsize is always left with room for the terminator.
All fixed-size destinations that reach this function (path[512], currentvalue[512], currentpassword/currentvalue[64], and the per-entry buffers in encodings[][512] and prerequisites[][512]) are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Change the comparison from "size > dst_size" to ">=" so conv_dst_size remains below the destination buffer size and the unconditional NUL terminator write has room.
Linux kernel platform/x86 hp-bioscfg Comparison in hp_get_string_from_buffer() = size >= dst_size
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel hp-bioscfg platform/x86 driver are exposed when hp_get_string_from_buffer() processes converted input whose length exactly matches a fixed-size destination buffer. The affected destinations include 512-byte path, current_value, encodings, and prerequisites buffers, plus 64-byte current_password/current_value buffers.
What input condition is required to trigger the overwrite?
The converted string length must be exactly equal to the destination buffer size. In that case, the function writes the NUL terminator one byte beyond the end of the destination buffer.
How can I determine whether a system has the fix?
Check whether the installed kernel includes the hp-bioscfg change that replaces the length comparison "size > dst_size" with "size >= dst_size" in hp_get_string_from_buffer(). The provided stable references identify commits containing the fix.