CVE-2026-81013: Linux Kernel Information Disclosure Vulnerability

CVE-2026-81013 Overview

CVE-2026-81013 is a heap out-of-bounds read vulnerability in the Linux kernel's hp-bioscfg platform driver under platform/x86. The flaw resides in validate_password_input(), which computes length = strlen(buf) and then reads buf[length - 1] to strip a trailing newline without first verifying that length is nonzero. Writing an empty string (a bare newline) to current_password or new_password produces length == 0, causing the driver to read buf[-1], one byte before the allocated heap buffer. KASAN flags the access as a slab-out-of-bounds read in store_password_instance reached through current_password_store and new_password_store.

Critical Impact
A local user with write access to the affected sysfs password attributes can trigger a one-byte heap out-of-bounds read in the kernel, potentially disclosing adjacent slab memory contents.

Affected Products

Linux kernel builds including the hp-bioscfg platform/x86 driver
HP systems relying on the hp-bioscfg sysfs interface for BIOS password management
Stable kernel branches prior to the fixes referenced in commits 0f9aad0, 21243c1, 2b2ec35, b699e5c, and cecb815

Discovery Timeline

2026-09-11 - CVE-2026-81013 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-81013

Vulnerability Analysis

The hp-bioscfg driver exposes sysfs attributes such as current_password and new_password that accept user-supplied input through write handlers. Inside validate_password_input(), the driver measures the input length with strlen(buf) and then unconditionally dereferences buf[length - 1] to trim a trailing newline character. When userspace writes a bare newline (which the kernel input path normalizes to an empty string), strlen(buf) returns zero and the subsequent expression buf[length - 1] becomes buf[-1].

KASAN reports the access as slab-out-of-bounds located 23 bytes to the right of an allocated 8-byte region, confirming the read occurs immediately outside the heap object holding the copied input. Execution continues past the invalid read because the returned byte only influences whether length is decremented, so the write completes with a success status. The result is a silent information read past the buffer rather than a crash [CWE-125].

Root Cause

The root cause is missing input validation before pointer arithmetic. The trailing-newline stripping logic assumes at least one byte is present in buf, but the write path allows a zero-length string after normalization. Without a nonzero-length precondition, buf[length - 1] indexes memory belonging to a neighboring slab allocation.

Attack Vector

Exploitation requires local access and permission to write to the affected sysfs nodes, typically restricted to privileged users. An attacker writes an empty payload (a single \n) to /sys/.../current_password or /sys/.../new_password, triggering the one-byte OOB read inside kernel slab memory. The vulnerability does not enable code execution or memory corruption, but the leaked byte reflects adjacent heap contents observable via KASAN or heap-shaping side channels.

See the upstream fixes for the exact patched logic: Kernel Commit 0f9aad0 and Kernel Commit cecb815.

// No verified exploit code is published for CVE-2026-81013.
// Refer to the upstream commits linked above for the patched
// validate_password_input() logic.

Detection Methods for CVE-2026-81013

Indicators of Compromise

KASAN reports containing slab-out-of-bounds in store_password_instance originating from the hp_bioscfg module.
Kernel log entries referencing current_password_store or new_password_store immediately preceded by writes of zero-length input.
Unexpected sysfs writes to current_password or new_password attributes from non-administrative processes.

Detection Strategies

Enable KASAN on test and pre-production kernels to surface the exact out-of-bounds read pattern described in the advisory.
Audit sysfs write activity to hp-bioscfg password attributes and correlate with the writing process identity.
Compare loaded hp_bioscfg module versions against fixed stable kernel releases using package inventory tooling.

Monitoring Recommendations

Forward kernel dmesg and audit subsystem events to a centralized log platform and alert on KASAN and slab-out-of-bounds strings.
Monitor sysfs write syscalls targeting hp-bioscfg paths through eBPF-based tracing or the Linux audit framework.
Track kernel package versions across HP endpoints and flag hosts still running pre-patch builds.

How to Mitigate CVE-2026-81013

Immediate Actions Required

Update affected Linux systems to a kernel release that includes the upstream fix referenced in the linked stable commits.
Restrict write permissions on hp-bioscfg sysfs password attributes to trusted administrative accounts only.
Unload the hp_bioscfg module on systems that do not require BIOS configuration through sysfs.

Patch Information

The fix modifies validate_password_input() to check that length is nonzero before evaluating buf[length - 1]. Backports are available in the following stable commits: Kernel Commit 0f9aad0, Kernel Commit 21243c1, Kernel Commit 2b2ec35, Kernel Commit b699e5c, and Kernel Commit cecb815.

Workarounds

Blacklist the hp_bioscfg module on hosts that do not manage HP BIOS settings through the Linux sysfs interface.
Enforce strict file permissions on /sys/class/firmware-attributes/hp-bioscfg/ so only privileged administrative processes can write password attributes.
Deploy Linux Security Module policies (SELinux or AppArmor) that deny write access to the affected sysfs attributes from unprivileged contexts.

bash

# Prevent the hp_bioscfg module from loading until the kernel is patched
echo 'blacklist hp_bioscfg' | sudo tee /etc/modprobe.d/hp-bioscfg-cve-2026-81013.conf
sudo rmmod hp_bioscfg 2>/dev/null || true
sudo update-initramfs -u