---
id: CVE-2026-90137
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  platform/x86: hp-bioscfg: fix password encoding bounds check

  The password PSWD_ENCODINGS parser reads password_obj[elem + pos_values]
  while copying the supported passw…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  platform/x86: hp-bioscfg: fix password encoding bounds check

  The password PSWD_ENCODINGS parser reads password_obj[elem + pos_values]
  while copying the supported passw…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8646a3b5ee3a5b384a22a721f37c24274d974045 <
    c224759555a13735b0d67561d818cefe00c3309a
  - >-
    Linux >= 8646a3b5ee3a5b384a22a721f37c24274d974045 <
    59fe8491ddaa03a510b352552e6ee291e7ce45d3
  - >-
    Linux >= 8646a3b5ee3a5b384a22a721f37c24274d974045 <
    ace1ba5fca0ab775b3641e154bcbc3ccde26a71a
  - >-
    Linux >= 8646a3b5ee3a5b384a22a721f37c24274d974045 <
    8a7499b8fd34438c1b11964e0e7ef5bd590fec92
  - >-
    Linux >= 8646a3b5ee3a5b384a22a721f37c24274d974045 <
    e213939ed9e6e6badf7aa48c4c8dd9a9cdf00615
  - Linux 6.6
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:17:43.270'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90137'
references:
  - url: 'https://git.kernel.org/stable/c/59fe8491ddaa03a510b352552e6ee291e7ce45d3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8a7499b8fd34438c1b11964e0e7ef5bd590fec92'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ace1ba5fca0ab775b3641e154bcbc3ccde26a71a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c224759555a13735b0d67561d818cefe00c3309a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e213939ed9e6e6badf7aa48c4c8dd9a9cdf00615'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.0019
epssPercentile: 0.0774
ingestedAt: '2026-09-17T16:21:47.879Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: hp-bioscfg: fix password encoding bounds check

The password PSWD_ENCODINGS parser reads password_obj[elem + pos_values]
while copying the supported password encodings from the ACPI package.

The outer loop only guarantees that elem is within password_obj_count.
The encoding count is bounded by MAX_ENCODINGS_SIZE, but that does not
guarantee that the ACPI package contains enough entries for all
elem + pos_values accesses.

A malformed package can therefore declare a non-zero encoding count
without providing enough string objects, causing the parser to read past
the ACPI package array and pass an out-of-bounds string pointer and
length to hp_convert_hexstr_to_str().

Add the same computed-index bounds check used by the other offset-based
package parsing loops before reading password_obj[elem + pos_values].

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.