CVE-2026-81014

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()

sk_store() and kek_store() strip a trailing newline from the sysfs

write before allocating the key buffer:

length = count;

if (buf[length - 1] == '\n')

length--;

bioscfg_drv.spm_data.signing_key = kmemdup(buf, length, GFP_KERNEL);

but then pass the original "count" (not "length") as the copy size to

hp_wmi_perform_query(), which memcpy()s that many bytes out of the

"length"-sized allocation, reading one byte past it whenever the write

ends in a newline, the normal case for a shell "echo" into sysfs.

KASAN confirms this directly:

BUG: KASAN: slab-out-of-bounds in hp_wmi_perform_query+0x1e9/0x460 [hp_bioscfg]

Read of size 28 at addr ffff88813c8e2b80 by task python3/16022

...

sk_store+0xa7/0x240 [hp_bioscfg]

kernfs_fop_write_iter+0x3e1/0x5d0

...

The buggy address is located 0 bytes inside of

allocated 27-byte region [ffff8

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References