CVE-2026-81011: Linux Kernel hp-bioscfg Buffer Overflow

CVE-2026-81011 Overview

CVE-2026-81011 is an out-of-bounds heap read vulnerability in the Linux kernel platform/x86: hp-bioscfg driver. The flaw resides in the per-type ACPI package parsers used to enumerate HP BIOS configuration attributes. The wrapper functions hp_populate_*_package_data() forward an element count derived from elements[0] instead of the validated obj->package.count. Because elements[0] is an ACPI_TYPE_STRING name field, the parsers read ->string.length through the union acpi_object, bounding themselves against the name string length rather than the real element array size. The issue is a prerequisite bug hardened ahead of a change that would relax package length validation.

Critical Impact
A local low-privileged user on affected HP hardware can trigger an out-of-bounds heap read in the kernel, enabling kernel memory disclosure or denial of service.

Affected Products

Linux kernel platform/x86 subsystem — hp-bioscfg driver
Linux stable kernel branches receiving the fix in commits 400cbc3, 4360178, 467e53f, a38127d, and e0ddfd7
HP systems that expose BIOS configuration attributes through ACPI to the hp-bioscfg driver

Discovery Timeline

2026-09-11 - CVE-2026-81011 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-81011

Vulnerability Analysis

The hp-bioscfg driver enumerates BIOS configuration attributes exposed through ACPI packages. hp_init_bios_package_attribute() validates obj->package.count against the expected per-type element count, then dispatches to one of five wrappers: string, integer, enumeration, ordered list, or password. Each wrapper calls its corresponding hp_populate_*_elements_from_package() parser, passing an element count. The bug is that this count is taken from elements[0] rather than the validated obj->package.count.

elements[0] is always the NAME field, typed as ACPI_TYPE_STRING. Accessing ->package.count on a string-typed union acpi_object actually reads the ->string.length member due to the shared union layout. The resulting bound reflects the length of the attribute name, not the size of the element array.

Today the condition is latent because hp_init_bios_package_attribute() rejects any package shorter than the type's fixed element count, so parsers only run against fully populated packages. An upcoming kernel change relaxes that check to accept shorter packages. Under the relaxed check, loop conditions such as elem < count and sub-loop guards such as elem + n >= count walk past the end of elements[], producing an out-of-bounds heap read.

Root Cause

The root cause is incorrect argument selection combined with union acpi_object type confusion. The parser wrappers forward elements[0].package.count when they should forward the previously validated obj->package.count. Because elements[0] is a string object, the field read overlaps string.length, silently substituting an unrelated size value.

Attack Vector

Exploitation requires local access with low privileges on a system running the vulnerable driver against a crafted or malformed ACPI BIOS package. When paired with the anticipated relaxation of the package length check, a package whose name string is longer than the real element array triggers reads beyond the allocated elements[] buffer, leaking adjacent kernel heap contents or crashing the kernel. See the Linux Kernel Commit 400cbc3 for the fix details.

Detection Methods for CVE-2026-81011

Indicators of Compromise

Kernel oops or KASAN reports referencing hp_populate_string_package_data, hp_populate_integer_package_data, hp_populate_enumeration_package_data, hp_populate_ordered_list_package_data, or hp_populate_password_package_data.
Unexpected hp-bioscfg driver load failures or attribute enumeration errors in dmesg on HP hardware.
Slab out-of-bounds read warnings originating from the platform/x86 subsystem during boot.

Detection Strategies

Inventory Linux hosts running kernels containing hp-bioscfg without the fix commits (400cbc3, 4360178, 467e53f, a38127d, e0ddfd7).
Enable KASAN in test environments to surface out-of-bounds reads during driver initialization.
Compare running kernel versions against distribution advisories that reference CVE-2026-81011.

Monitoring Recommendations

Forward kernel logs to a centralized store and alert on BUG:, KASAN:, or WARNING: entries tied to the hp-bioscfg module.
Track privilege boundary events on HP endpoints where local users can invoke BIOS configuration interfaces.
Monitor package management events for kernel updates that carry the upstream fix.

How to Mitigate CVE-2026-81011

Immediate Actions Required

Apply the vendor kernel update that incorporates the referenced stable commits as soon as it is available for your distribution.
Restrict local shell and interactive access on HP systems that expose the hp-bioscfg driver until patching is complete.
Audit which HP endpoints load the hp-bioscfg module and prioritize them for remediation.

Patch Information

The upstream fix forwards the validated obj->package.count to every *_package_data() wrapper so parsers bound iteration against the true package size. The fix is present in Linux stable commits 400cbc3, 4360178, 467e53f, a38127d, and e0ddfd7. Behavior for correctly enumerated packages is unchanged.

Workarounds

Blocklist the hp-bioscfg kernel module on affected hosts where BIOS configuration management is not required.
Enforce least-privilege access to reduce the pool of local users capable of triggering the driver code path.
Deploy KASAN-enabled kernels in non-production tiers to detect exploitation attempts prior to broad rollout.

bash

# Prevent hp-bioscfg from loading until the kernel is patched
echo "blacklist hp_bioscfg" | sudo tee /etc/modprobe.d/blacklist-hp-bioscfg.conf
sudo rmmod hp_bioscfg 2>/dev/null || true
sudo update-initramfs -u