CVE-2026-23131: Linux Kernel Kobject Vulnerability

CVE-2026-23131 Overview

CVE-2026-23131 is a medium-severity vulnerability in the Linux kernel's hp-bioscfg driver under platform/x86. The driver attempts to register kobjects with empty names when the HP BIOS returns attributes containing empty name strings. This triggers kernel warnings from kobject_add_internal+0x2eb/0x310 at lib/kobject.c:219 and can lead to denial of service conditions on affected systems. The flaw affects Linux kernel 6.19 release candidates and earlier stable branches running on HP hardware where the BIOS returns malformed attribute data.

Critical Impact
A local authenticated user on HP hardware can trigger kernel warnings and impact system availability when the BIOS exposes attributes with empty name strings to the hp-bioscfg driver.

Affected Products

Linux kernel 6.19-rc1 through 6.19-rc6
Earlier Linux stable kernel branches containing the hp-bioscfg driver
HP systems exposing BIOS configuration attributes via WMI

Discovery Timeline

2026-02-14 - CVE-2026-23131 published to NVD
2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-23131

Vulnerability Analysis

The hp-bioscfg driver exposes HP BIOS configuration attributes to userspace through the Linux sysfs interface. The driver parses attribute metadata from Windows Management Instrumentation (WMI) buffers supplied by the HP BIOS firmware. When the BIOS returns an attribute with an empty name string, the driver still calls kobject_add_internal() to register a sysfs entry for that attribute. The kernel's kobject subsystem rejects registration of objects with empty names and emits a WARNING backtrace.

Each malformed attribute generates a fresh kernel warning, producing log noise that can fill ring buffers and consume system resources. The condition is categorized under [NVD-CWE-noinfo] and falls within input validation failure patterns for kernel driver code that trusts firmware-supplied data.

Root Cause

The root cause is missing validation in hp_init_bios_buffer_attribute(). The function parses attribute names directly from the WMI buffer without checking whether the resulting string is empty before forwarding it to the kobject registration path. The kernel community resolved the issue by adding an explicit empty-string check, logging a debug message, and skipping registration of the offending attribute so the module continues processing remaining valid attributes.

Attack Vector

Exploitation requires local access with low privileges on an affected HP system. The attacker does not need user interaction. The condition triggers automatically during driver initialization or attribute enumeration when the BIOS returns malformed data. While the vulnerability does not impact confidentiality or integrity, it can affect availability through repeated warning generation, kernel log flooding, and potential disruption of the BIOS configuration subsystem.

No public proof-of-concept exploit exists for CVE-2026-23131 and the EPSS data reflects very low probability of in-the-wild exploitation.

Detection Methods for CVE-2026-23131

Indicators of Compromise

Kernel log entries containing kobject: ... attempted to be registered with empty name!
WARNING backtraces referencing kobject_add_internal at lib/kobject.c:219
Repeated hp-bioscfg driver messages during boot or module load on HP hardware

Detection Strategies

Monitor dmesg and /var/log/kern.log output for kobject empty-name warnings tied to the hp-bioscfg module.
Inventory HP endpoints running kernel versions in the affected range and correlate with BIOS firmware revisions known to return empty attribute names.
Track abnormal growth in kernel ring buffer volume on Linux endpoints with HP firmware.

Monitoring Recommendations

Forward kernel logs from Linux endpoints into a centralized SIEM or data lake for pattern matching against the warning signature.
Alert on repeated WARNING events from lib/kobject.c originating on the same host within short time windows.
Track kernel version and module load events across HP-manufactured Linux fleets to prioritize patching.

How to Mitigate CVE-2026-23131

Immediate Actions Required

Apply the upstream Linux kernel patches that add empty-name validation in hp_init_bios_buffer_attribute().
Identify HP endpoints running affected kernel versions and schedule kernel updates through your distribution's stable channel.
Restrict local shell access on HP Linux systems to trusted administrative users until patches are deployed.

Patch Information

The fix is available in the following upstream Linux kernel commits:

Update to a kernel build that incorporates these commits and reboot affected systems.

Workarounds

Unload or blacklist the hp-bioscfg kernel module on systems that do not require runtime BIOS configuration access.
Update HP system firmware to a revision that does not expose attributes with empty name strings.
Limit local logon rights on affected systems to reduce the number of accounts capable of triggering driver initialization paths.