The Linux kernel's platform/x86 hp-bioscfg password encoding parser reads entries from an ACPI package without adequately verifying that the computed index (elem + pos_values) is within the bounds of the password_obj array. While the outer loop ensures elem is within password_obj_count and the encoding count is limited by MAX_ENCODINGS_SIZE, these checks do not guarantee that the ACPI package contains enough entries for all accesses. Consequently, a malformed ACPI package can cause the parser to read past the array bounds, passing an out-of-bounds string pointer and length to hp_convert_hexstr_to_str(). The vulnerability is addressed by adding a computed-index bounds check similar to other offset-based parsing loops.

This vulnerability can lead to out-of-bounds memory reads, which may expose sensitive information (confidentiality impact) and cause denial of service (availability impact) due to improper handling of malformed ACPI packages. The CVSS score of 7.7 reflects a high severity with local attack vector, low attack complexity, no privileges required, no user interaction, and unchanged scope.

A fix has been implemented in the Linux kernel to add proper bounds checking before accessing the password encoding array in the hp-bioscfg component. Users and administrators should apply the official kernel updates that include this patch to remediate the vulnerability. Since this is a kernel-level issue, upgrading to the fixed kernel version is the recommended mitigation.