CVE-2026-90137platform/x86: hp-bioscfg: fix password encoding bounds check
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWD_ENCODINGS parser reads password_obj[elem + pos_values] while copying the supported password encodings from the ACPI package. The outer loop only guarantees that elem is within password_obj_count. The encoding count is bounded by MAX_ENCODINGS_SIZE, but that does not guarantee that the ACPI package contains enough entries for all elem + pos_values accesses. A malformed package can therefore declare a non-zero encoding count without providing enough string objects, causing the parser to read past the ACPI package array and pass an out-of-bounds string pointer and length to hp_convert_hexstr_to_str(). Add the same computed-index bounds check used by the other offset-based package parsing loops before reading password_obj[elem + pos_values].
- CVSS
- 7.7 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 8646a3b5ee3a5b384a22a721f37c24274d974045 before c224759555a13735b0d67561d818cefe00c3309a; 8646a3b5ee3a5b384a22a721f37c24274d974045 builds before 59fe8491ddaa03a510b352552e6ee291e7ce45d3; from 8646a3b5ee3a5b384a22a721f37c24274d974045 before ace1ba5fca0ab775b3641e154bcbc3ccde26a71a; 8646a3b5ee3a5b384a22a721f37c24274d974045 builds before 8a7499b8fd34438c1b11964e0e7ef5bd590fec92; from 8646a3b5ee3a5b384a22a721f37c24274d974045 before e213939ed9e6e6badf7aa48c4c8dd9a9cdf00615 | CNA record |
References
- https://git.kernel.org/stable/c/c224759555a13735b0d67561d818cefe00c3309a
- https://git.kernel.org/stable/c/59fe8491ddaa03a510b352552e6ee291e7ce45d3
- https://git.kernel.org/stable/c/ace1ba5fca0ab775b3641e154bcbc3ccde26a71a
- https://git.kernel.org/stable/c/8a7499b8fd34438c1b11964e0e7ef5bd590fec92
- https://git.kernel.org/stable/c/e213939ed9e6e6badf7aa48c4c8dd9a9cdf00615
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.