Out-of-bounds read in Linux kernel - CVE-2026-81011
Published: September 12, 2026
Vulnerability identifier: #VU149390
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-81011
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in the hp-bioscfg package parsers when parsing ACPI BIOS configuration attribute packages. A local user can cause the kernel to parse a short package whose name length exceeds its element count to disclose sensitive information.
The condition requires acceptance of packages that are shorter than the element count expected for their attribute type.
Affected software
Linux kernel
How to mitigate CVE-2026-81011
Install security update from vendor's repository.