{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "a34fc329b1895fc8a6eb12099adc47009421ba6a"
            },
            {
              "fixed": "467e53f231f77a1677191b8cdabdaf1448439d55"
            },
            {
              "fixed": "436017808c7cbcdb5e49b2142090d4391e3de9a6"
            },
            {
              "fixed": "a38127df99ae8b1851560b35b837c9952416143a"
            },
            {
              "fixed": "400cbc3ccc88a5ad37cd85056224635ce9eba018"
            },
            {
              "fixed": "e0ddfd77c0c320b7d12b6c9169303b140b798775"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.6.0"
            },
            {
              "fixed": "6.6.157"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.109"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.50"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81011.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: hp-bioscfg: pass validated element count to package parsers\n\nThe per-type package parsers are handed the wrong element count.\n\nhp_init_bios_package_attribute() validates obj-\u003epackage.count and then\ncalls one of the five hp_populate_*_package_data() wrappers (string,\ninteger, enumeration, ordered list, password). Each wrapper forwards a\ncount to its hp_populate_*_elements_from_package() parser, but instead\nof forwarding the validated obj-\u003epackage.count it derives the count\nfrom elements[0]. elements[0] is the NAME field and is always an\nACPI_TYPE_STRING, so reading -\u003epackage.count from it in fact reads\n-\u003estring.length through the union acpi_object. The parsers thus bound\nthemselves against the length of the name string rather than against\nthe real number of elements in the package.\n\nThis is safe today because hp_init_bios_package_attribute() refuses any\npackage that has fewer than the type's element count, so a parser only\never runs on a full package and never reads past it regardless of the\nbogus bound.\n\nAn upcoming change relaxes that check to accept shorter packages. Once\na parser can receive fewer elements than its per-type count, a bound\ntaken from the name length no longer reflects the array size, and the\n\"elem \u003c count\" loop conditions and \"elem + n \u003e= count\" sub-loop guards\nread past the end of elements[] - an out-of-bounds heap read.\n\nForward the validated obj-\u003epackage.count to every *_package_data()\nwrapper so the parsers bound themselves against the real package size.\nThis does not change behaviour for the packages that enumerate\ncorrectly today and is a prerequisite for accepting shorter packages\nsafely.",
  "id": "CVE-2026-81011",
  "modified": "2026-09-16T03:30:48.114256608Z",
  "published": "2026-09-11T19:43:01.422Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/400cbc3ccc88a5ad37cd85056224635ce9eba018"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/436017808c7cbcdb5e49b2142090d4391e3de9a6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/467e53f231f77a1677191b8cdabdaf1448439d55"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a38127df99ae8b1851560b35b837c9952416143a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e0ddfd77c0c320b7d12b6c9169303b140b798775"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81011.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81011"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "platform/x86: hp-bioscfg: pass validated element count to package parsers"
}