CVE-2026-89628

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: picolcd: clamp eeprom debugfs read to bytes actually received

picolcd_debug_eeprom_read() trusts resp->raw_data[2] -- a length byte

supplied by the device in its REPORT_EE_DATA reply -- clamped only to

the caller's read() count:

ret = resp->raw_data[2];

if (ret > s)

ret = s;

if (copy_to_user(u, resp->raw_data+3, ret))

It never checks resp->raw_size, the number of bytes picolcd_raw_event()

actually copied into the 64-byte raw_data[] of the kmalloc'd struct

picolcd_pending. A device (or a spoofed picoLCD) returning a length byte

of 0xff, read with a count >= 255, makes copy_to_user() read past

raw_data[] into adjacent slab memory and return it to userspace through

the debugfs "eeprom" file:

BUG: KASAN: slab-out-of-bounds in _copy_to_user

Read of size 255 ... picolcd_debug_eeprom_read+0x214/0x2f0 [hid_picolcd]

The debug-dump path in the same file already validates the device length

byte against the recei

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References