Look up another CVE · open CVE-2026-90137 in the interactive tracker
CVE-2026-90137
platform/x86: hp-bioscfg: fix password encoding bounds check
Published 2026-09-17 (31 days ago) by the Linux kernel CNA. Subsystem drivers/platform. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-90137 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The password PSWD_ENCODINGS parser reads password_obj[elem + pos_values] while copying the supported password encodings from the ACPI package. The outer loop only guarantees that elem is within password_obj_count. The encoding count is bounded by MAX_ENCODINGS_SIZE, but that does not guarantee that the ACPI package contains enough entries for all elem + pos_values accesses. A malformed package can therefore declare a non-zero encoding count without providing enough string objects, causing the parser to read past the ACPI package array and pass an out-of-bounds string pointer and length to hp_convert_hexstr_to_str(). Add the same computed-index bounds check used by the other offset-based package parsing loops before reading password_obj[elem + pos_values].
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/platform/x86/hp/hp-bioscfg/passwdobj-attributes.c
- What this is
- HP BIOSCFG DRIVERMAINTAINERS section matched on drivers/platform/x86/hp/hp-bioscfg/ · platform-driver-x86@vger.kernel.org · Maintained
- Kernel module
- hp_bioscfg
Check it on the machine
grep -wE 'CONFIG_HP_BIOSCFG|CONFIG_X86|CONFIG_X86_PLATFORM_DRIVERS_HP' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w hp_bioscfgPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed. The build rule could not be established for 1 release, so nothing is claimed about those.
- bookworm?
- trixieMnot built on amd64/cloud-amd64, arm64/arm64, arm64/arm64-16k, arm64/cloud-arm64, arm64/rt/arm64, armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- forky, sidMnot built on amd64/cloud-amd64, arm64/arm64, arm64/arm64-16k, arm64/cloud-arm64, arm64/rt-arm64, armhf/armmp, armhf/armmp-lpae, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- bookworm · linux-6.12Mnot built on amd64/cloud-amd64, arm64/arm64, arm64/arm64-16k, arm64/cloud-arm64, arm64/rt/arm64, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le, ppc64el/powerpc64le-64k
- ?
- not established - no Makefile entry for the affected file
- M
- a module where it is built at all; some flavours do not build it
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switches
- CONFIG_HP_BIOSCFG, CONFIG_X86, CONFIG_X86_PLATFORM_DRIVERS_HP
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-17 (31 days ago)source
- CVSS
- 7.7 high
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.18%, higher than 7.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/platform
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.6 | 6.6.157 | c224759555a1 |
| 6.6 | 6.12.110 | 59fe8491ddaa |
| 6.6 | 6.18.52 | ace1ba5fca0a |
| 6.6 | 7.2.6 | 8a7499b8fd34 |
| 6.6 | 7.3 | e213939ed9e6 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The malformed bytes are the ACPI package from wmi_query_block() on HP_WMI_BIOS_PASSWORD_GUID, walked by hp_populate_password_elements_from_package() during hp_init()/hp_init_bios_attributes(); that is local HP WMI/ACPI firmware data, not a network, Bluetooth/WiFi, or USB protocol message.
- AC:LAttack complexity, low
- A password package whose PSWD_SIZE/encodings_size is non-zero but that lacks encodings_size string objects makes the PSWD_ENCODINGS loop read password_obj[elem+pos_values] past password_obj_count on every probe; firmware sets both the count and the package length, with no race required.
- PR:NPrivileges required, none
- hp_init() calls hp_init_bios_attributes(HPWMI_PASSWORD_TYPE) and hp_populate_password_elements_from_package() with no capable(), credential, or sysfs check; a compromised HP BIOS that returns a short password package triggers the PSWD_ENCODINGS over-read at module init without a Linux user account.
- UI:NUser interaction, none
- HP_WMI_BIOS_PASSWORD_GUID instances are enumerated automatically in hp_init() when HP_WMI_BIOS_GUID is present (module_init/built-in probe); the victim does not need to write current_password/new_password, mount a filesystem, or take any other action.
- S:UScope, unchanged
- The over-read is of the kernel heap array obj->package.elements and any oops or copied encodings stay in the same host kernel authority; this WMI password parser is not a KVM/Xen guest-to-host or IOMMU/DMA boundary crossing.
- C:HConfidentiality impact, high
- Each out-of-bounds slot is treated as string.pointer and string.length and passed to hp_convert_hexstr_to_str(), which kmallocs that length and reads the pointer; the result is strscpy'd into password_data->encodings[] and emitted by the 0444 encodings sysfs show, so the read is not a few bounded bytes.
- I:NIntegrity impact, none
- The PSWD_ENCODINGS loop only reads out-of-bounds union acpi_object fields and then 2-argument strscpy()s the conversion into encodings[MAX_ENCODINGS_SIZE][MAX_BUFF_SIZE]; parsed results never write past that fixed array, so there is no OOB write or control-flow hijack primitive.
- A:HAvailability impact, high
- hp_convert_hexstr_to_str() dereferences password_obj[elem+pos_values].string.pointer; an invalid pointer taken from an out-of-bounds ACPI package slot causes a kernel oops or panic while enumerating HP_WMI_BIOS_PASSWORD_GUID instances in hp_init().