{"id":"CVE-2026-81013","title":"platform/x86: hp-bioscfg: fix heap OOB read on empty password write","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: hp-bioscfg: fix heap OOB read on empty password write\n\nvalidate_password_input() computes length = strlen(buf) and then\nchecks buf[length - 1] to strip a …","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-125"],"vendor":"Linux","product":"Linux","affected":["Linux >= 8646a3b5ee3a5b384a22a721f37c24274d974045 < 21243c15e1d31f0df1517435e3a7784747f19043","Linux >= 8646a3b5ee3a5b384a22a721f37c24274d974045 < cecb8154bd5fa6c8ddbd1a4e8216bbc0f0eb9828","Linux >= 8646a3b5ee3a5b384a22a721f37c24274d974045 < 0f9aad08424882dd5714b53d29ae044060890752","Linux >= 8646a3b5ee3a5b384a22a721f37c24274d974045 < b699e5c1f63a9e79946c35598c8a6f7af2c356b8","Linux >= 8646a3b5ee3a5b384a22a721f37c24274d974045 < 2b2ec354f905c14e3270e8ec3ab50f7d8ad73bab","Linux 6.6"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:46:38.578Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-81013","references":[{"url":"https://git.kernel.org/stable/c/21243c15e1d31f0df1517435e3a7784747f19043"},{"url":"https://git.kernel.org/stable/c/cecb8154bd5fa6c8ddbd1a4e8216bbc0f0eb9828"},{"url":"https://git.kernel.org/stable/c/0f9aad08424882dd5714b53d29ae044060890752"},{"url":"https://git.kernel.org/stable/c/b699e5c1f63a9e79946c35598c8a6f7af2c356b8"},{"url":"https://git.kernel.org/stable/c/2b2ec354f905c14e3270e8ec3ab50f7d8ad73bab"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81013.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-81013"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532351"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81013"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81013"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-81013.mbox"}],"tags":["cve.org","csaf","vex","red-hat"],"epss":0.00181,"epssPercentile":0.07572,"ingestedAt":"2026-09-14T15:23:07.454Z","slug":"CVE-2026-81013","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: hp-bioscfg: fix heap OOB read on empty password write\n\nvalidate_password_input() computes length = strlen(buf) and then\nchecks buf[length - 1] to strip a trailing newline, without checking\nthat length is nonzero first. Writing an empty string (a bare '\\n')\nto current_password or new_password gives length == 0, and\nbuf[length - 1] reads buf[-1], one byte before the heap allocation\nholding the copied input.\n\nKASAN confirms this directly:\n\n  BUG: KASAN: slab-out-of-bounds in store_password_instance.constprop.0+0x223/0x2a0 [hp_bioscfg]\n  Read of size 1 at addr ffff88811bd8da9f by task sh/13740\n  ...\n  store_password_instance.constprop.0+0x223/0x2a0 [hp_bioscfg]\n  current_password_store+0x14/0x20 [hp_bioscfg]\n  ...\n  The buggy address is located 23 bytes to the right of\n  allocated 8-byte region [ffff88811bd8da80, ffff88811bd8da88)\n\nReproduced identically via new_password_store. Execution continues\npast the bad read (the garbage byte only affects whether \"length\" is\ndecremented by one), so the write completes and returns success; this\nis a pure information read past the buffer, not a crash, but it is\nstill an out-of-bounds access KASAN correctly flags.\n\nFix by only checking buf[length - 1] when length is nonzero.\n\n## Affected\n\n- `Linux >= 8646a3b5ee3a5b384a22a721f37c24274d974045 < 21243c15e1d31f0df1517435e3a7784747f19043`\n- `Linux >= 8646a3b5ee3a5b384a22a721f37c24274d974045 < cecb8154bd5fa6c8ddbd1a4e8216bbc0f0eb9828`\n- `Linux >= 8646a3b5ee3a5b384a22a721f37c24274d974045 < 0f9aad08424882dd5714b53d29ae044060890752`\n- `Linux >= 8646a3b5ee3a5b384a22a721f37c24274d974045 < b699e5c1f63a9e79946c35598c8a6f7af2c356b8`\n- `Linux >= 8646a3b5ee3a5b384a22a721f37c24274d974045 < 2b2ec354f905c14e3270e8ec3ab50f7d8ad73bab`\n- `Linux 6.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81013.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":204128,"id":"CVE-2026-81013","ts":1789490231876,"field":"cvss","old":null,"new":"5.5"},{"seq":204127,"id":"CVE-2026-81013","ts":1789490231876,"field":"severity","old":"none","new":"medium"},{"seq":147345,"id":"CVE-2026-81013","ts":1789270210542,"field":"cvss","old":null,"new":"4.7"},{"seq":147344,"id":"CVE-2026-81013","ts":1789270210542,"field":"severity","old":"none","new":"medium"},{"seq":109098,"id":"CVE-2026-81013","ts":1789183730297,"field":"cvss","old":null,"new":"4.7"},{"seq":109097,"id":"CVE-2026-81013","ts":1789183730297,"field":"severity","old":"none","new":"medium"}]}