The Linux kernel's hp-bioscfg component contained an off-by-one write vulnerability in the hp_get_string_from_buffer() function. The function clamps the converted string length against the destination buffer size using a 'size > dst_size' comparison, which fails to reserve space for the null terminator when the converted length equals the buffer size. Consequently, the null terminator is written one byte past the buffer boundary. The fix changes the comparison to '>=' to ensure space is always reserved for the terminator. This vulnerability affects all fixed-size destination buffers that reach this function, including path[512], current_value[512], current_password/current_value[64], and per-entry buffers in encodings[][512] and prerequisites[][512].

The off-by-one write can cause a buffer overflow by writing a null terminator beyond the allocated buffer boundary. While the exact impact is not detailed, such memory corruption issues can potentially lead to system instability or security risks such as privilege escalation or information disclosure if exploited. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel source code by changing the comparison operator to prevent the off-by-one write. Users should apply the official kernel updates that include this fix once available. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or kernel mailing list advisories for the latest remediation guidance.