CVE-2026-90137

A flaw was found in the Linux kernel's hp-bioscfg component. The password encoding parser, specifically the PSWD_ENCODINGS parser, does not adequately validate the number of entries when processing an ACPI (Advanced Configuration and Power Interface) package. A malformed ACPI package can cause the parser to read beyond the intended memory boundaries. This out-of-bounds read could lead to information disclosure or a denial of service (DoS) on the affected system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.