UBUNTU-CVE-2026-90137: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWDENCODINGS parser reads passwordobj[elem + posvalues] while copying the supported password encodings from the ACPI package. The outer loop only guarantees that elem is within passwordobjcount. The encoding count is bounded by MAXENCODINGSSIZE, but that does not guarantee that the ACPI package contains enough entries for all elem + posvalues accesses. A malformed package can therefore declare a non-zero encoding count without providing enough string objects, causing the parser to read past the ACPI package array and pass an out-of-bounds string pointer and length to hpconverthexstrtostr(). Add the same computed-index bounds check used by the other offset-based package parsing loops before reading passwordobj[elem + posvalues].
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the hp-bioscfg password PSWD_ENCODINGS parser, add the same computed-index bounds check used by the other offset-based package parsing loops before reading password_obj[elem + pos_values]. Ensure elem + pos_values is within the ACPI package bounds before accessing the entry.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected software list includes Ubuntu kernel packages for linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop. The vulnerable code is in the platform/x86 hp-bioscfg driver, so exposure depends on that driver parsing the relevant HP BIOS ACPI password-encoding package.
What must occur for exploitation?
A malformed ACPI package must declare a non-zero password encoding count while omitting enough string objects for the declared entries. This causes hp-bioscfg to access beyond the ACPI package array and pass an out-of-bounds string pointer and length to hp_convert_hexstr_to_str().
What is the potential impact?
The issue is rated high with a 7.7 CVSS score and vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. The stated impacts are high confidentiality and availability impact, with no integrity impact.