CVE-2026-81012

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1

Description An off-by-one write exists in the hp get string from buffer() function within the platform/x86: hp-bioscfg component. The function clamps the converted string length against the destination buffer size using a size > dst size comparison. When the converted length equals dst size, the NUL terminator is written one byte past the destination buffer. This affects several fixed-size destinations, including path[512], current value[512], current password/current value[64], and per-entry buffers in encodings[][512] and prerequisites[][512].

Recommendations Update the Linux kernel to version 7.2.6-1.1 or later.