{"id":"CVE-2026-81012","revision":"266743eb3a0b4eed89783af14e4eb592","records":[{"revision":"266743eb3a0b4eed89783af14e4eb592","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-81012","aliases":[],"title":"platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()\n\nhp_get_string_from_buffer() clamps the converted string length against\nthe destination buffer size with \"size > dst_size\", so when the\nconverted length is exactly equal to dst_size, conv_dst_size is left\nat dst_size and the unconditional NUL terminator write\n\n\tdst[conv_dst_size] = 0;\n\nlands one byte past the destination buffer. This is the same shape of\nbug as the previously fixed off-by-one in hp_convert_hexstr_to_str():\nthe buffer is sized correctly for the content, but the terminator\nwrite is never checked against that size.\n\nFix by changing the comparison to \">=\" so conv_dst_size is always left\nwith room for the terminator.\n\nAll fixed-size destinations that reach this function (path[512],\ncurrent_value[512], current_password/current_value[64], and the\nper-entry buffers in encodings[][512] and prerequisites[][512]) are\naffected.","state":0,"publishedAt":"2026-09-11T19:43:02.082+00:00","modifiedAt":"2026-10-19T08:46:37.44+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/platform/x86/hp/hp-bioscfg/bioscfg.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"a34fc329b1895fc8a6eb12099adc47009421ba6a\",\n                            \"lessThan\": \"8f5aa1506cdddea6b33584c2445b9ce99eeddb64\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a34fc329b1895fc8a6eb12099adc47009421ba6a\",\n                            \"lessThan\": \"3cc772d0154799961f032e5a992d4a50523e291a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a34fc329b1895fc8a6eb12099adc47009421ba6a\",\n                            \"lessThan\": \"b15b334fbc3c0c46440f8a892ebf62164fca23d6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a34fc329b1895fc8a6eb12099adc47009421ba6a\",\n                            \"lessThan\": \"ddf98cf33529714b3ba1a158afb1db5b0f759a1a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a34fc329b1895fc8a6eb12099adc47009421ba6a\",\n                            \"lessThan\": \"dc03f05e419f3460342fb7564884f244622634b6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/platform/x86/hp/hp-bioscfg/bioscfg.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.6\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.6\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.109\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.50\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.4,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/8f5aa1506cdddea6b33584c2445b9ce99eeddb64","https://git.kernel.org/stable/c/3cc772d0154799961f032e5a992d4a50523e291a","https://git.kernel.org/stable/c/b15b334fbc3c0c46440f8a892ebf62164fca23d6","https://git.kernel.org/stable/c/ddf98cf33529714b3ba1a158afb1db5b0f759a1a","https://git.kernel.org/stable/c/dc03f05e419f3460342fb7564884f244622634b6"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-81012","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-81012","identifiers":["CVE-2026-81012"]},"retained":false,"historicalAffected":[]}],"coverage":[]}