CVE-2026-81011

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: hp-bioscfg: pass validated element count to package parsers

The per-type package parsers are handed the wrong element count.

hp_init_bios_package_attribute() validates obj->package.count and then

calls one of the five hp_populate_*_package_data() wrappers (string,

integer, enumeration, ordered list, password). Each wrapper forwards a

count to its hp_populate_*_elements_from_package() parser, but instead

of forwarding the validated obj->package.count it derives the count

from elements[0]. elements[0] is the NAME field and is always an

ACPI_TYPE_STRING, so reading ->package.count from it in fact reads

->string.length through the union acpi_object. The parsers thus bound

themselves against the length of the name string rather than against

the real number of elements in the package.

This is safe today because hp_init_bios_package_attribute() refuses any

package that has fewer than the type's element count

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References