« Volver al listado

CVE-2026-81011

Estado: RecibidaAlta (7.1)—

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: hp-bioscfg: pass validated element count to package parsers

The per-type package parsers are handed the wrong element count.

hp_init_bios_package_attribute() validates obj->package.count and then calls one of the five hp_populate_*_package_data() wrappers (string, integer, enumeration, ordered list, password).

Leer descripción completaMostrar menos

Each wrapper forwards a count to its hp_populate_*_elements_from_package() parser, but instead of forwarding the validated obj->package.count it derives the count from elements[0]. elements[0] is the NAME field and is always an ACPI_TYPE_STRING, so reading ->package.count from it in fact reads ->string.length through the union acpi_object. The parsers thus bound themselves against the length of the name string rather than against the real number of elements in the package.

This is safe today because hp_init_bios_package_attribute() refuses any package that has fewer than the type's element count, so a parser only ever runs on a full package and never reads past it regardless of the bogus bound.

An upcoming change relaxes that check to accept shorter packages. Once a parser can receive fewer elements than its per-type count, a bound taken from the name length no longer reflects the array size, and the "elem < count" loop conditions and "elem + n >= count" sub-loop guards read past the end of elements[] - an out-of-bounds heap read.

Forward the validated obj->package.count to every *_package_data() wrapper so the parsers bound themselves against the real package size. This does not change behaviour for the packages that enumerate correctly today and is a prerequisite for accepting shorter packages safely.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad local (AV:L, PR:L) de lectura de memoria heap en kernel Linux. Permite leer datos fuera de límites mediante desbordamiento de búfer en parsers de paquetes ACPI.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareData Loss Prevention

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-81011",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "a34fc329b1895fc8a6eb12099adc47009421ba6a",
              "lessThan": "467e53f231f77a1677191b8cdabdaf1448439d55",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a34fc329b1895fc8a6eb12099adc47009421ba6a",
              "lessThan": "436017808c7cbcdb5e49b2142090d4391e3de9a6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a34fc329b1895fc8a6eb12099adc47009421ba6a",
              "lessThan": "a38127df99ae8b1851560b35b837c9952416143a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a34fc329b1895fc8a6eb12099adc47009421ba6a",
              "lessThan": "400cbc3ccc88a5ad37cd85056224635ce9eba018",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a34fc329b1895fc8a6eb12099adc47009421ba6a",
              "lessThan": "e0ddfd77c0c320b7d12b6c9169303b140b798775",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/platform/x86/hp/hp-bioscfg/bioscfg.c",
            "drivers/platform/x86/hp/hp-bioscfg/bioscfg.h",
            "drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c",
            "drivers/platform/x86/hp/hp-bioscfg/int-attributes.c",
            "drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c",
            "drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c",
            "drivers/platform/x86/hp/hp-bioscfg/string-attributes.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.6",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/platform/x86/hp/hp-bioscfg/bioscfg.c",
            "drivers/platform/x86/hp/hp-bioscfg/bioscfg.h",
            "drivers/platform/x86/hp/hp-bioscfg/enum-attributes.c",
            "drivers/platform/x86/hp/hp-bioscfg/int-attributes.c",
            "drivers/platform/x86/hp/hp-bioscfg/order-list-attributes.c",
            "drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c",
            "drivers/platform/x86/hp/hp-bioscfg/string-attributes.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:19:09.927",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/400cbc3ccc88a5ad37cd85056224635ce9eba018",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/436017808c7cbcdb5e49b2142090d4391e3de9a6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/467e53f231f77a1677191b8cdabdaf1448439d55",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a38127df99ae8b1851560b35b837c9952416143a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e0ddfd77c0c320b7d12b6c9169303b140b798775",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: hp-bioscfg: pass validated element count to package parsers\n\nThe per-type package parsers are handed the wrong element count.\n\nhp_init_bios_package_attribute() validates obj->package.count and then\ncalls one of the five hp_populate_*_package_data() wrappers (string,\ninteger, enumeration, ordered list, password). Each wrapper forwards a\ncount to its hp_populate_*_elements_from_package() parser, but instead\nof forwarding the validated obj->package.count it derives the count\nfrom elements[0]. elements[0] is the NAME field and is always an\nACPI_TYPE_STRING, so reading ->package.count from it in fact reads\n->string.length through the union acpi_object. The parsers thus bound\nthemselves against the length of the name string rather than against\nthe real number of elements in the package.\n\nThis is safe today because hp_init_bios_package_attribute() refuses any\npackage that has fewer than the type's element count, so a parser only\never runs on a full package and never reads past it regardless of the\nbogus bound.\n\nAn upcoming change relaxes that check to accept shorter packages. Once\na parser can receive fewer elements than its per-type count, a bound\ntaken from the name length no longer reflects the array size, and the\n\"elem < count\" loop conditions and \"elem + n >= count\" sub-loop guards\nread past the end of elements[] - an out-of-bounds heap read.\n\nForward the validated obj->package.count to every *_package_data()\nwrapper so the parsers bound themselves against the real package size.\nThis does not change behaviour for the packages that enumerate\ncorrectly today and is a prerequisite for accepting shorter packages\nsafely."
    }
  ],
  "lastModified": "2026-09-14T13:18:55.480",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}