CVE-2026-90137: platform/x86: hp-bioscfg: fix password encoding bounds check
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: hp-bioscfg: fix password encoding bounds check
The password PSWDENCODINGS parser reads passwordobj[elem + posvalues] while copying the supported password encodings from the ACPI package.
The outer loop only guarantees that elem is within passwordobjcount. The encoding count is bounded by MAXENCODINGSSIZE, but that does not guarantee that the ACPI package contains enough entries for all elem + posvalues accesses.
A malformed package can therefore declare a non-zero encoding count without providing enough string objects, causing the parser to read past the ACPI package array and pass an out-of-bounds string pointer and length to hpconverthexstrtostr().
Add the same computed-index bounds check used by the other offset-based package parsing loops before reading passwordobj[elem + posvalues].
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel hp-bioscfg platform/x86 driver are exposed when that driver parses a malformed ACPI password-encoding package. The issue is tied to ACPI data consumed by the driver, not to ordinary password input.
What does an attacker need to exploit it?
An attacker needs to cause hp-bioscfg to parse an ACPI package that declares password encodings but does not contain enough string objects for the declared entries. This leads to an out-of-bounds package-array read and passes an invalid string pointer and length to hp_convert_hexstr_to_str().
What can be done if the fix cannot be applied immediately?
Avoid parsing malformed or untrusted ACPI password-encoding packages through hp-bioscfg. The provided data does not identify a configuration-only mitigation or a way to detect prior exploitation.