CVE-2026-90137 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: hp-bioscfg: fix password encoding bounds check
The password PSWD_ENCODINGS parser reads password_obj[elem + pos_values]
while copying the supported password encodings from the ACPI package.
The outer loop only guarantees that elem is within password_obj_count. The encoding count is bounded by MAX_ENCODINGS_SIZE, but that does not guarantee that the ACPI package contains enough entries for all elem + pos_values accesses.
A malformed package can therefore declare a non-zero encoding count without providing enough string objects, causing the parser to read past the ACPI package array and pass an out-of-bounds string pointer and length to hp_convert_hexstr_to_str().
Add the same computed-index bounds check used by the other offset-based package parsing loops before reading password_obj[elem + pos_values].
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the Linux kernel within the platform/x86/hp-bioscfg driver represents a critical out-of-bounds read condition arising from insufficient validation of ACPI package structures. This specific component is responsible for managing BIOS configuration settings on HP systems, including the parsing and processing of password encoding schemes defined by the Advanced Configuration and Power Interface specification. The core technical flaw lies in the logic governing the PSWD_ENCODINGS parser, which iterates through an array of supported password encodings extracted from ACPI data structures provided by the system firmware. During this process, the code attempts to access elements at index elem plus pos_values within the password_obj array. While the outer loop correctly ensures that the base element index remains within the declared count of items in the package, it fails to verify whether the cumulative offset required for accessing specific encoding strings stays within the actual bounds of the allocated memory region associated with the ACPI object.
This discrepancy creates a scenario where a malformed or maliciously crafted ACPI table can declare a non-zero number of supported encodings without actually providing sufficient string objects in the underlying data structure. Consequently, when the parser proceeds to read password_obj[elem + pos_values], it accesses memory locations beyond the intended boundaries of the package array. This out-of-bounds access results in the retrieval of invalid or arbitrary kernel memory contents as if they were valid encoding strings. These malformed pointers and lengths are subsequently passed to the hp_convert_hexstr_to_str function, which attempts to process these values without further validation. Such behavior constitutes a classic buffer over-read vulnerability that can lead to information disclosure by leaking sensitive kernel data into user-space applications or system logs, potentially revealing cryptographic keys, internal state variables, or other confidential information stored in adjacent memory regions.
From an operational perspective, the impact of this flaw extends beyond mere information leakage. Depending on how the subsequent processing functions handle invalid inputs, there is a potential risk for denial-of-service conditions if the kernel encounters unexpected data formats that trigger panic states or undefined behavior during string conversion operations. Furthermore, because ACPI tables are often populated by firmware, an attacker with physical access to the machine could potentially craft malicious BIOS configurations to exploit this flaw during boot sequences or when system configuration tools query available settings. This aligns closely with CWE-125, which describes out-of-bounds read vulnerabilities where software reads data past the end of a buffer or array. The attack vector is primarily classified under ATT&CK technique T1083, involving file and directory discovery through ACPI interfaces, although the exploitation requires specific conditions regarding firmware configuration capabilities.
The resolution implemented in this patch addresses the root cause by introducing a computed-index bounds check prior to accessing password_obj[elem + pos_values]. This additional validation ensures that both the base index and any offsets applied during iteration remain strictly within the limits of the ACPI package array size. By enforcing strict boundary checks similar to those used in other offset-based parsing loops within the same driver, the code now guarantees safe memory access patterns regardless of how many encodings are declared by the firmware. This fix prevents the parser from reading past the end of the allocated structure and eliminates the possibility of passing invalid pointers to downstream conversion functions.
To mitigate similar risks across the broader Linux kernel ecosystem, developers should adhere strictly to defensive programming practices when parsing external data structures provided by hardware or firmware interfaces. It is essential to validate not only the declared count of items but also the actual size of the underlying buffer against any computed indices used for access. Regular auditing of ACPI parsers and other low-level configuration handlers can help identify analogous weaknesses before they are exploited in production environments. System administrators should ensure that their systems run patched versions of the kernel where this specific bounds check has been integrated, thereby closing the gap between declared structure sizes and actual memory safety guarantees.