Out-of-bounds read in Linux kernel - CVE-2026-81013

Vulnerability details

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in validate_password_input() in the hp-bioscfg password attribute handling when writing an empty string to current_password or new_password. A local user can write an empty string to a password attribute to disclose sensitive information.

Affected software

How to mitigate CVE-2026-81013

External References

• https://git.kernel.org/stable/c/0f9aad08424882dd5714b53d29ae044060890752
• https://git.kernel.org/stable/c/2b2ec354f905c14e3270e8ec3ab50f7d8ad73bab
• https://git.kernel.org/stable/c/b699e5c1f63a9e79946c35598c8a6f7af2c356b8
• https://git.kernel.org/stable/c/cecb8154bd5fa6c8ddbd1a4e8216bbc0f0eb9828

Related Security Bulletins

• Out-of-bounds read in Linux kernel hp hp-bioscfg driver