Executive brief
The Linux kernel's picoLCD HID device driver contains a buffer over-read vulnerability in its EEPROM debugfs interface. A malicious or spoofed picoLCD device can cause the kernel to read and leak adjacent kernel memory to userspace through the debugfs eeprom file. This requires physical access via USB and root-level file access to exploit, so the practical risk is limited but could expose sensitive kernel data in multi-user systems.
Technical details
The vulnerability is an out-of-bounds read in picolcd_debug_eeprom_read() in drivers/hid/hid-picolcd_debugfs.c. The function trusts a device-supplied length byte (resp->raw_data[2]) from a REPORT_EE_DATA HID report without validating it against the actual number of bytes received (resp->raw_size). A crafted device returning a length byte of 0xff, when read with a count ≥255, causes copy_to_user() to read 255 bytes from the 64-byte raw_data[] buffer, overrunning it into adjacent slab memory and leaking it to userspace. The fix clamps the copy length to resp->raw_size - 3, ensuring only the received payload is copied. Attack prerequisites: crafted USB HID device (or device spoofing), root access to the debugfs eeprom file, and the picolcd driver must be loaded.
Affected products
- Linux Linux kernel all versions prior to fix; see stable kernel branches
Timeline
- 2026-09-11: disclosed
- 2026-09-14: patched