Executive brief
The Linux kernel's picolcd HID driver contains an integer overflow vulnerability in the picolcd_send_and_wait() function that could lead to a NULL pointer dereference. This affects systems using PicoLCD display devices. While the practical exploitability is limited, an attacker with physical access to a device or control over HID input could potentially trigger a kernel crash or hang.
Technical details
The vulnerability is an integer overflow in a signed loop counter 'k' within the picolcd_send_and_wait() function in drivers/hid/hid-picolcd_core.c. If the loop executes more than INT_MAX times, the counter 'k' can become negative, causing the condition 'k < size' to evaluate as true even when 'size' is 0, leading to an out-of-bounds access and potential NULL pointer dereference of 'raw_data'. The fix changes 'k' from a signed int to an unsigned int to prevent overflow. The vulnerability was discovered via static analysis by the Linux Verification Center using the Svace tool. The fix is available in Linux kernel commit 0021eb09041f021c079be1022934a280f7f176c0.
Affected products
- Linux Linux kernel All versions containing the picolcd HID driver (affected by original code in commit fabdbf2fd22fa17)
Timeline
- 2026-08-28: disclosed: Published on NVD
- 2026-05-17: patched: Patch committed to Linux kernel stable tree
- 2026-06-29: patched: Merged to mainline by Jiri Kosina