CVE-2026-23062: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23062 is a NULL pointer dereference vulnerability in the Linux kernel's platform/x86: hp-bioscfg driver that causes a kernel panic when accessing sysfs BIOS configuration attributes. The flaw was published on February 4, 2026, and affects Linux kernel versions 6.6.x before 6.6.122, 6.7 through 6.12.x before 6.12.68, 6.13 through 6.18.x before 6.18.8, and 6.19-rc1 through 6.19-rc6. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The vulnerability (CWE-476: NULL Pointer Dereference) stems from two distinct bugs in the GET_INSTANCE_ID macro within the hp-bioscfg driver. First, an off-by-one error uses <= instead of < as the loop boundary condition, causing out-of-bounds array access since indices range from 0 to instances_count-1. Second, the code dereferences attr_name_kobj->name without first checking whether attr_name_kobj is NULL, triggering a null pointer dereference in attribute show functions such as min_length_show(). The panic manifests as Oops: general protection fault [#1] SMP KASAN NOPTI with KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] (Feedly). The fix adds a NULL check for attr_name_kobj before dereferencing and corrects the loop boundary to use < (Kernel Patch 1, Kernel Patch 2).

Successful exploitation causes a kernel panic (general protection fault), resulting in a system crash and denial of service. The vulnerability is triggered locally when any application — such as fwupd — reads BIOS configuration attributes via sysfs, making it exploitable by low-privileged local users. There is no impact on confidentiality or integrity; the sole consequence is loss of system availability (Feedly).

Exploitation requires local access with low privileges and no user interaction, making it accessible to any authenticated local user on an affected system. No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing Oops: general protection fault [#1] SMP KASAN NOPTI and KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] with RIP: 0010:min_length_show+0xcf/0x1d0 [hp_bioscfg].
• Process: Unexpected system crashes or reboots occurring when fwupd or similar firmware management tools attempt to read BIOS configuration attributes via sysfs.
• File System: Kernel crash dump files (e.g., /var/crash/) generated around the time of sysfs BIOS attribute access on HP hardware.

Update the Linux kernel to a patched version: 6.6.122 or later, 6.12.68 or later, 6.18.8 or later, or 6.19-rc7 or later. Patch commits are available at the upstream kernel repository (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3, Kernel Patch 4). Distribution-specific updates are available for SUSE, Oracle Linux, and Ubuntu (Ubuntu USN-8278-1, Ubuntu USN-8289-1, Ubuntu USN-8296-1). As a temporary workaround where patching is not immediately possible, restrict local user access to sysfs BIOS configuration attributes and avoid running firmware update tools such as fwupd on affected kernel versions.