CVE-2026-89628

A flaw was found in the Human Interface Device HID picolcd driver in the Linux kernel. A local attacker with root privileges, by using a specially crafted or spoofed picoLCD device, could exploit an out-of-bounds read vulnerability in the picolcddebugeepromread function. This flaw occurs because...

AZL-100241 CVE-2026-89628 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

CVE-2026-89628

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

UBUNTU-CVE-2026-89628

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

EUVD-2026-76540

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

CVE-2026-89628

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

CVE-2026-89628 HID: picolcd: clamp eeprom debugfs read to bytes actually received

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

PT-2026-90344

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the picolcd debug eeprom read function where it trusts a length byte provided by a device in its REPORT EE DATA reply. The function fails to verify this length against...

PT-2026-96388

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcd debug eeprom read trusts resp-raw data2 -- a length byte supplied by the device in its REPORT EE DATA reply -- clamped only to the caller's read count: re...

SUSE CVE-2026-80781

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field-usage in hidsetfield hidsetfield hands field-usage + offset to hiddumpinput before the guard that bounds offset: hiddumpinputfield-report-device, field-usage + offset, value; if offset =...

CVE-2026-80781

CVE-2026-80781 is an out-of-bounds read in the Linux kernel's HID core subsystem. The function hid_set_field() passes field->usage + offset to hid_dump_input() before validating that the offset is within field->report_count. When CONFIG_DEBUG_FS is enabled, hid_dump_input() dereferences the...

PT-2026-85622

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field-usage in hid set field hid set field hands field-usage + offset to hid dump input before the guard that bounds offset: hid dump inputfield-report-device, field-usage + offset, value; if offset =...

CVE-2026-80605

A flaw was found in the Linux kernel. An integer overflow in the picolcdsendandwait function within the Human Interface Device HID picolcd driver can occur when a signed loop counter overflows. This can lead to an incorrect condition evaluation, resulting in a NULL pointer dereference. This...

Linux Distros Unpatched Vulnerability : CVE-2026-80605

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: picolcd: prevent NULL pointer dereference in picolcdsendandwait In picolcdsendandwait, an integer overflow of the signed loop counter 'k' can theoretically...

SUSE CVE-2026-80605

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: prevent NULL pointer dereference in picolcdsendandwait In picolcdsendandwait, an integer overflow of the signed loop counter 'k' can theoretically lead to a NULL pointer dereference of 'rawdata'. If the loop execute...

CVE-2026-80605

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: prevent NULL pointer dereference in picolcdsendandwait In picolcdsendandwait, an integer overflow of the signed loop counter 'k' can theoretically lead to a NULL pointer dereference of 'rawdata'. If the loop execute...

UBUNTU-CVE-2026-80605

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: prevent NULL pointer dereference in picolcdsendandwait In picolcdsendandwait, an integer overflow of the signed loop counter 'k' can theoretically lead to a NULL pointer dereference of 'rawdata'. If the loop execute...

CVE-2026-80605

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: prevent NULL pointer dereference in picolcdsendandwait In picolcdsendandwait, an integer overflow of the signed loop counter 'k' can theoretically lead to a NULL pointer dereference of 'rawdata'. If the loop execute...

CVE-2026-80605 HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: prevent NULL pointer dereference in picolcdsendandwait In picolcdsendandwait, an integer overflow of the signed loop counter 'k' can theoretically lead to a NULL pointer dereference of 'rawdata'. If the loop execute...

CVE-2026-80605

CVE-2026-80605 affects the Linux kernel in the HID: picolcd driver, specifically the picolcd_send_and_wait() function. The root cause is an integer overflow of the signed loop counter k: if the loop executes more than INT_MAX times, k wraps to a negative value, causing the condition k