CVE-2026-81012 Overview
CVE-2026-81012 is an off-by-one write vulnerability in the Linux kernel's hp-bioscfg driver under platform/x86. The flaw resides in hp_get_string_from_buffer(), which clamps a converted string length against the destination buffer size using size > dst_size. When the converted length equals dst_size exactly, the function writes an unconditional NUL terminator one byte past the destination buffer. This mirrors a previously fixed off-by-one defect in hp_convert_hexstr_to_str(). Fixed-size destinations reaching this function include path[512], current_value[512], current_password/current_value[64], and the per-entry buffers in encodings[][512] and prerequisites[][512].
Critical Impact
A single-byte out-of-bounds write in kernel memory can corrupt adjacent kernel structures, enabling local attackers to compromise confidentiality, integrity, and availability of the system.
Affected Products
- Linux kernel builds that include the platform/x86: hp-bioscfg driver
- HP systems relying on the HP BIOS Configuration Utility kernel interface
- Distributions shipping kernels prior to the applied stable fix commits
Discovery Timeline
- 2026-09-11 - CVE-2026-81012 published to the National Vulnerability Database (NVD)
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-81012
Vulnerability Analysis
The hp-bioscfg driver exposes HP BIOS attributes to user space through sysfs. Within hp_get_string_from_buffer(), the driver converts a WMI-provided string into a destination buffer. The bounds check size > dst_size allows conv_dst_size to remain equal to dst_size when the converted length exactly matches the destination capacity. The subsequent statement dst[conv_dst_size] = 0; then writes a NUL byte at offset dst_size, one position beyond the last valid index. This produces a heap or stack out-of-bounds write of a single byte, depending on where the destination buffer is allocated. Affected destinations include on-stack path[512] and current_value[512] buffers, as well as heap-backed per-entry arrays in encodings[][512] and prerequisites[][512]. The fix replaces the comparison with >=, guaranteeing space for the terminator [CWE-193, CWE-787].
Root Cause
The root cause is an incorrect boundary comparison. Using strict greater-than instead of greater-than-or-equal leaves no room for the mandatory NUL terminator when the converted length equals the buffer size. This is a classic off-by-one boundary condition error that violates the invariant that a string of length N requires N+1 bytes when terminated.
Attack Vector
Exploitation requires local access to a system running an affected kernel with the hp-bioscfg driver loaded. An attacker able to influence the WMI-provided input processed by hp_get_string_from_buffer() can trigger the one-byte overwrite. Depending on adjacent kernel memory layout, the corrupted byte can alter control data, metadata, or pointers, leading to privilege escalation, kernel information disclosure, or a denial of service via kernel panic.
No verified public exploit code is available. Refer to the upstream stable commits for the corrective patch details.
Detection Methods for CVE-2026-81012
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing hp_get_string_from_buffer or hp-bioscfg in dmesg and /var/log/kern.log
- KASAN slab-out-of-bounds or stack-out-of-bounds reports involving symbols in drivers/platform/x86/hp/hp-bioscfg/
- Unexplained corruption of adjacent kernel objects observed during BIOS attribute reads or writes via sysfs
Detection Strategies
- Enable Kernel Address Sanitizer (KASAN) on test systems to surface the one-byte out-of-bounds write during BIOS attribute enumeration
- Inventory running kernel versions across HP endpoints and correlate against the fixed stable commits 3cc772d, 8f5aa15, b15b334, dc03f05, and ddf98cf
- Alert on repeated kernel warnings originating from the platform/x86 subsystem on HP hardware
Monitoring Recommendations
- Forward kernel logs to a centralized log platform and create rules matching hp-bioscfg faults or KASAN reports
- Monitor for unexpected local process activity accessing /sys/class/firmware-attributes/ on HP systems
- Track kernel version drift across the fleet and flag hosts running unpatched builds of the affected driver
How to Mitigate CVE-2026-81012
Immediate Actions Required
- Apply the upstream stable kernel patches referenced by commits 3cc772d, 8f5aa15, b15b334, dc03f05, and ddf98cf
- Update to a distribution kernel package that includes the fix for hp_get_string_from_buffer()
- Restrict local access to affected HP systems until the patched kernel is deployed
Patch Information
The fix changes the boundary comparison in hp_get_string_from_buffer() from > to >=, ensuring conv_dst_size always leaves room for the trailing NUL byte. Patches are available across multiple stable branches. See the upstream references: Kernel Git Commit 3cc772d, Kernel Git Commit 8f5aa15, Kernel Git Commit b15b334, Kernel Git Commit dc03f05, and Kernel Git Commit ddf98cf.
Workarounds
- Unload the hp-bioscfg module on systems that do not require runtime BIOS attribute configuration
- Blacklist the driver via modprobe configuration where BIOS attribute management can be handled out-of-band
- Limit local login and interactive shell access on HP endpoints to trusted administrators until patched
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.