CVE-2026-81014: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-81014 Overview

CVE-2026-81014 is a heap out-of-bounds read vulnerability in the Linux kernel's hp-bioscfg platform driver. The flaw affects the sk_store() and kek_store() functions in the HP BIOS configuration sysfs interface. Both functions strip a trailing newline character from user input before allocating a key buffer with kmemdup(), but then pass the original count value instead of the reduced length to hp_wmi_perform_query(). This causes memcpy() to read one byte past the allocated region whenever a write ends with a newline, which is the normal case for shell echo commands writing to sysfs.

Critical Impact
Local heap out-of-bounds read of one byte adjacent to a slab allocation, potentially exposing kernel memory contents on HP systems using the hp-bioscfg driver.

Affected Products

Linux kernel with hp-bioscfg platform/x86 driver enabled
HP business-class systems that load the hp-bioscfg driver for BIOS configuration through sysfs
Distributions shipping kernels prior to the referenced stable commits

Discovery Timeline

2026-09-11 - CVE-2026-81014 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-81014

Vulnerability Analysis

The vulnerability lives in the HP BIOS configuration driver at drivers/platform/x86/hp/hp-bioscfg/. The sk_store() (signing key) and kek_store() (key exchange key) handlers accept writes from userspace through sysfs attributes. Both functions compute a length variable equal to count minus one when the buffer ends with a newline. They then allocate a buffer of exactly length bytes using kmemdup(buf, length, GFP_KERNEL).

The defect is in the subsequent call to hp_wmi_perform_query(), which receives the original count as its copy size. The helper invokes memcpy() on the shorter allocation using the larger count, reading one byte beyond the slab object boundary. KASAN reports confirm the pattern: Read of size 28 at addr ... located 0 bytes inside of allocated 27-byte region. The issue reproduces at multiple write sizes including 28, 57, and 201 bytes.

Root Cause

The root cause is inconsistent use of two size variables that track the same buffer. After trimming the newline, length accurately reflects the allocation size, but count still reflects the raw sysfs write size. Passing count to the WMI query helper produces a size mismatch that manifests as a one-byte [CWE-125] out-of-bounds read from the kernel slab allocator.

Attack Vector

Exploitation requires local access with sufficient privileges to write to the affected sysfs attributes exposed by the hp-bioscfg driver. These attributes are typically restricted to root. An attacker with write access can trigger the OOB read by issuing a normal shell echo command to the signing key or key exchange key sysfs node. The read leaks one byte of adjacent slab memory into the WMI request path, which may be observable through error paths or via repeated allocation shaping to expose sensitive kernel data.

The upstream fix passes length instead of count to hp_wmi_perform_query() in both functions, aligning the copy size with the actual allocation. Refer to the linked stable commits for the exact patch content: Linux Kernel Commit 4c6374d, Linux Kernel Commit 67b6070, Linux Kernel Commit 7cd8fe0, Linux Kernel Commit 81db79f, and Linux Kernel Commit a7508c7.

Detection Methods for CVE-2026-81014

Indicators of Compromise

KASAN kernel log entries reporting slab-out-of-bounds in hp_wmi_perform_query+0x1e9/0x460 [hp_bioscfg]
Kernel stack traces showing sk_store or kek_store from hp_bioscfg above kernfs_fop_write_iter
Unexpected writes to sysfs attributes exposed by the hp-bioscfg driver from non-administrative processes

Detection Strategies

Enable KASAN on test kernels to surface the exact Read of size N at addr ... signature for this bug
Audit sysfs write activity targeting hp-bioscfg signing key and key exchange key attributes
Correlate process execution telemetry with writes to HP BIOS configuration paths under /sys/class/firmware-attributes/ on HP hardware

Monitoring Recommendations

Collect Linux kernel logs centrally and alert on KASAN or BUG: messages referencing hp_bioscfg
Track patch state of HP endpoints and flag kernels lacking the fix commits listed under git.kernel.org/stable
Monitor for unexpected loading of the hp_bioscfg module on systems that do not require HP BIOS configuration tooling

How to Mitigate CVE-2026-81014

Immediate Actions Required

Apply vendor kernel updates that include the upstream fix on all HP systems running the hp-bioscfg driver
Restrict write access to hp-bioscfg sysfs attributes to the minimum set of administrative users
Unload the hp_bioscfg module on systems that do not use HP BIOS configuration workflows

Patch Information

The fix replaces count with length in the call to hp_wmi_perform_query() within both sk_store() and kek_store(), ensuring the memcpy size matches the kmemdup() allocation. Backports are available in the stable trees referenced by commits 4c6374d, 67b6070, 7cd8fe0, 81db79f, and a7508c7. Consume the fix through your distribution's kernel update channel.

Workarounds

Blacklist the hp_bioscfg kernel module where BIOS configuration through sysfs is not required
Tighten permissions on the affected sysfs attributes so only trusted administrators can write to them
Avoid shell echo style writes when interacting with the affected attributes on unpatched systems, as trailing newlines trigger the OOB read

bash

# Prevent the vulnerable module from loading until the kernel is patched
echo "blacklist hp_bioscfg" | sudo tee /etc/modprobe.d/blacklist-hp-bioscfg.conf
sudo modprobe -r hp_bioscfg