CVE-2026-81013

A flaw was found in the hp-bioscfg component of the Linux kernel. A local user could trigger a heap out-of-bounds read by writing an empty string to the current_password or new_password fields. This occurs because the validate_password_input() function attempts to access memory before the allocated buffer when processing an empty input. This vulnerability could lead to information disclosure by reading one byte of data past the buffer.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.