GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-89628

Vulnerability from fkie_nvd - Published: 2026-09-11 20:19 - Updated: 2026-09-14 13:19
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcd_debug_eeprom_read() trusts resp->raw_data[2] -- a length byte supplied by the device in its REPORT_EE_DATA reply -- clamped only to the caller's read() count: ret = resp->raw_data[2]; if (ret > s) ret = s; if (copy_to_user(u, resp->raw_data+3, ret)) It never checks resp->raw_size, the number of bytes picolcd_raw_event() actually copied into the 64-byte raw_data[] of the kmalloc'd struct picolcd_pending. A device (or a spoofed picoLCD) returning a length byte of 0xff, read with a count >= 255, makes copy_to_user() read past raw_data[] into adjacent slab memory and return it to userspace through the debugfs "eeprom" file: BUG: KASAN: slab-out-of-bounds in _copy_to_user Read of size 255 ... picolcd_debug_eeprom_read+0x214/0x2f0 [hid_picolcd] The debug-dump path in the same file already validates the device length byte against the received size before trusting it; this read does not. The file is created S_IRUSR (root-only) and a crafted device is needed, so it is neither unprivileged- nor remotely-triggerable. Clamp the copy length to resp->raw_size - 3 (the payload actually received, minus the 3-byte header), floored at 0 for short replies.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1a02056c2bf7ef9b5fd05ee6913aeeadb703c443
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/471f4a939c66d1d44aece2321807abf609fc9098
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4daf432c94a42e7be6aa10b012b33af5ed9bc118
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/65daa322f1021d8206f8032c4cd4c0cb2d26c7c3
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/699a3c8b56e168ca19d12722f3f5ef1d6f4b1d84
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8dc662af019158690c470edd2e2857657f700abb
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a3e6e8d7198a9f3861861520a38b673684a1062b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e9c667395ac1f8024f623250b32bae4c7af9caa0
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-picolcd_debugfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1a02056c2bf7ef9b5fd05ee6913aeeadb703c443",
              "status": "affected",
              "version": "9bbf2b98ba11d00bd73e3254e15cfe17ccaff6ba",
              "versionType": "git"
            },
            {
              "lessThan": "65daa322f1021d8206f8032c4cd4c0cb2d26c7c3",
              "status": "affected",
              "version": "9bbf2b98ba11d00bd73e3254e15cfe17ccaff6ba",
              "versionType": "git"
            },
            {
              "lessThan": "8dc662af019158690c470edd2e2857657f700abb",
              "status": "affected",
              "version": "9bbf2b98ba11d00bd73e3254e15cfe17ccaff6ba",
              "versionType": "git"
            },
            {
              "lessThan": "4daf432c94a42e7be6aa10b012b33af5ed9bc118",
              "status": "affected",
              "version": "9bbf2b98ba11d00bd73e3254e15cfe17ccaff6ba",
              "versionType": "git"
            },
            {
              "lessThan": "a3e6e8d7198a9f3861861520a38b673684a1062b",
              "status": "affected",
              "version": "9bbf2b98ba11d00bd73e3254e15cfe17ccaff6ba",
              "versionType": "git"
            },
            {
              "lessThan": "471f4a939c66d1d44aece2321807abf609fc9098",
              "status": "affected",
              "version": "9bbf2b98ba11d00bd73e3254e15cfe17ccaff6ba",
              "versionType": "git"
            },
            {
              "lessThan": "699a3c8b56e168ca19d12722f3f5ef1d6f4b1d84",
              "status": "affected",
              "version": "9bbf2b98ba11d00bd73e3254e15cfe17ccaff6ba",
              "versionType": "git"
            },
            {
              "lessThan": "e9c667395ac1f8024f623250b32bae4c7af9caa0",
              "status": "affected",
              "version": "9bbf2b98ba11d00bd73e3254e15cfe17ccaff6ba",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-picolcd_debugfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.35"
            },
            {
              "lessThan": "2.6.35",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: picolcd: clamp eeprom debugfs read to bytes actually received\n\npicolcd_debug_eeprom_read() trusts resp-\u003eraw_data[2] -- a length byte\nsupplied by the device in its REPORT_EE_DATA reply -- clamped only to\nthe caller\u0027s read() count:\n\n\tret = resp-\u003eraw_data[2];\n\tif (ret \u003e s)\n\t\tret = s;\n\tif (copy_to_user(u, resp-\u003eraw_data+3, ret))\n\nIt never checks resp-\u003eraw_size, the number of bytes picolcd_raw_event()\nactually copied into the 64-byte raw_data[] of the kmalloc\u0027d struct\npicolcd_pending. A device (or a spoofed picoLCD) returning a length byte\nof 0xff, read with a count \u003e= 255, makes copy_to_user() read past\nraw_data[] into adjacent slab memory and return it to userspace through\nthe debugfs \"eeprom\" file:\n\n\tBUG: KASAN: slab-out-of-bounds in _copy_to_user\n\tRead of size 255 ... picolcd_debug_eeprom_read+0x214/0x2f0 [hid_picolcd]\n\nThe debug-dump path in the same file already validates the device length\nbyte against the received size before trusting it; this read does not.\nThe file is created S_IRUSR (root-only) and a crafted device is needed,\nso it is neither unprivileged- nor remotely-triggerable.\n\nClamp the copy length to resp-\u003eraw_size - 3 (the payload actually\nreceived, minus the 3-byte header), floored at 0 for short replies."
    }
  ],
  "id": "CVE-2026-89628",
  "lastModified": "2026-09-14T13:19:16.513",
  "metrics": {},
  "published": "2026-09-11T20:19:48.270",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1a02056c2bf7ef9b5fd05ee6913aeeadb703c443"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/471f4a939c66d1d44aece2321807abf609fc9098"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4daf432c94a42e7be6aa10b012b33af5ed9bc118"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/65daa322f1021d8206f8032c4cd4c0cb2d26c7c3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/699a3c8b56e168ca19d12722f3f5ef1d6f4b1d84"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8dc662af019158690c470edd2e2857657f700abb"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a3e6e8d7198a9f3861861520a38b673684a1062b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e9c667395ac1f8024f623250b32bae4c7af9caa0"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.