« Volver al listado

CVE-2026-89628

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

HID: picolcd: clamp eeprom debugfs read to bytes actually received

picolcd_debug_eeprom_read() trusts resp->raw_data[2] -- a length byte supplied by the device in its REPORT_EE_DATA reply -- clamped only to the caller's read() count:

It never checks resp->raw_size, the number of bytes picolcd_raw_event() actually copied into the 64-byte raw_data[] of the kmalloc'd struct picolcd_pending. A device (or a spoofed picoLCD) returning a length byte of 0xff, read with a count >= 255, makes copy_to_user() read past raw_data[] into adjacent slab memory and return it to userspace through the debugfs "eeprom" file:

Leer descripción completaMostrar menos

The debug-dump path in the same file already validates the device length byte against the received size before trusting it; this read does not. The file is created S_IRUSR (root-only) and a crafted device is needed, so it is neither unprivileged- nor remotely-triggerable.

Clamp the copy length to resp->raw_size - 3 (the payload actually received, minus the 3-byte header), floored at 0 for short replies.

Detalles técnicos trazas, registros y código del informe original
	ret = resp->raw_data[2];
	if (ret > s)
		ret = s;
	if (copy_to_user(u, resp->raw_data+3, ret))

	BUG: KASAN: slab-out-of-bounds in _copy_to_user
	Read of size 255 ... picolcd_debug_eeprom_read+0x214/0x2f0 [hid_picolcd]

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89628",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "9bbf2b98ba11d00bd73e3254e15cfe17ccaff6ba",
              "lessThan": "1a02056c2bf7ef9b5fd05ee6913aeeadb703c443",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9bbf2b98ba11d00bd73e3254e15cfe17ccaff6ba",
              "lessThan": "65daa322f1021d8206f8032c4cd4c0cb2d26c7c3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9bbf2b98ba11d00bd73e3254e15cfe17ccaff6ba",
              "lessThan": "8dc662af019158690c470edd2e2857657f700abb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9bbf2b98ba11d00bd73e3254e15cfe17ccaff6ba",
              "lessThan": "4daf432c94a42e7be6aa10b012b33af5ed9bc118",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9bbf2b98ba11d00bd73e3254e15cfe17ccaff6ba",
              "lessThan": "a3e6e8d7198a9f3861861520a38b673684a1062b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9bbf2b98ba11d00bd73e3254e15cfe17ccaff6ba",
              "lessThan": "471f4a939c66d1d44aece2321807abf609fc9098",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9bbf2b98ba11d00bd73e3254e15cfe17ccaff6ba",
              "lessThan": "699a3c8b56e168ca19d12722f3f5ef1d6f4b1d84",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9bbf2b98ba11d00bd73e3254e15cfe17ccaff6ba",
              "lessThan": "e9c667395ac1f8024f623250b32bae4c7af9caa0",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/hid/hid-picolcd_debugfs.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.35"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.35",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/hid/hid-picolcd_debugfs.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:19:48.270",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1a02056c2bf7ef9b5fd05ee6913aeeadb703c443",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/471f4a939c66d1d44aece2321807abf609fc9098",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4daf432c94a42e7be6aa10b012b33af5ed9bc118",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/65daa322f1021d8206f8032c4cd4c0cb2d26c7c3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/699a3c8b56e168ca19d12722f3f5ef1d6f4b1d84",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8dc662af019158690c470edd2e2857657f700abb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a3e6e8d7198a9f3861861520a38b673684a1062b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e9c667395ac1f8024f623250b32bae4c7af9caa0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: picolcd: clamp eeprom debugfs read to bytes actually received\n\npicolcd_debug_eeprom_read() trusts resp->raw_data[2] -- a length byte\nsupplied by the device in its REPORT_EE_DATA reply -- clamped only to\nthe caller's read() count:\n\n\tret = resp->raw_data[2];\n\tif (ret > s)\n\t\tret = s;\n\tif (copy_to_user(u, resp->raw_data+3, ret))\n\nIt never checks resp->raw_size, the number of bytes picolcd_raw_event()\nactually copied into the 64-byte raw_data[] of the kmalloc'd struct\npicolcd_pending. A device (or a spoofed picoLCD) returning a length byte\nof 0xff, read with a count >= 255, makes copy_to_user() read past\nraw_data[] into adjacent slab memory and return it to userspace through\nthe debugfs \"eeprom\" file:\n\n\tBUG: KASAN: slab-out-of-bounds in _copy_to_user\n\tRead of size 255 ... picolcd_debug_eeprom_read+0x214/0x2f0 [hid_picolcd]\n\nThe debug-dump path in the same file already validates the device length\nbyte against the received size before trusting it; this read does not.\nThe file is created S_IRUSR (root-only) and a crafted device is needed,\nso it is neither unprivileged- nor remotely-triggerable.\n\nClamp the copy length to resp->raw_size - 3 (the payload actually\nreceived, minus the 3-byte header), floored at 0 for short replies."
    }
  ],
  "lastModified": "2026-09-14T13:19:16.513",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}