The Linux kernel's hp-bioscfg driver had a heap out-of-bounds read vulnerability in the sk_store() and kek_store() functions. These functions remove a trailing newline from sysfs writes before allocating a buffer but then incorrectly use the original write length (including the newline) when copying data, leading to a read one byte past the allocated buffer. This was reproducible with multiple write sizes and confirmed by Kernel Address Sanitizer (KASAN). The fix involved passing the corrected length (excluding the newline) to the hp_wmi_perform_query() function to prevent out-of-bounds access.

This vulnerability causes a heap out-of-bounds read, which can lead to information disclosure or kernel instability. The read occurs one byte past the allocated buffer during sysfs writes to the hp-bioscfg driver. No known exploits in the wild have been reported.

A fix is available that corrects the length parameter passed to hp_wmi_perform_query() in the sk_store() and kek_store() functions. Users should update to a Linux kernel version that includes this patch once released. No additional mitigation steps are indicated.