CVE-2026-80605

A flaw was found in the Linux kernel. An integer overflow in the picolcd_send_and_wait() function within the Human Interface Device (HID) picolcd driver can occur when a signed loop counter overflows. This can lead to an incorrect condition evaluation, resulting in a NULL pointer dereference. This vulnerability could allow a local attacker to cause a system crash, leading to a Denial of Service (DoS).

A flaw rated LOW impact by Red Hat Product Security was found in the Linux kernel HID picolcd driver shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. In picolcd_send_and_wait(), an integer overflow of the signed loop counter 'k' can theoretically lead to a NULL pointer dereference of 'raw_data': if the loop executes more than INT_MAX times, 'k' becomes negative, making the condition 'k < size' true even when 'size' is 0. A local attacker able to exercise this code path on a system with picoLCD HID hardware could use this flaw to cause a system crash, resulting in a denial of service; confidentiality and integrity are not affected. The issue was found by static analysis (Linux Verification Center, Svace) and is considered theoretical because it requires an extreme loop count. Red Hat Enterprise Linux 7 ELS through 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 kernel components are affected, and the fix is currently deferred given the low impact and theoretical nature of the issue; the residual risk is limited to a local denial of service. Red Hat Enterprise Linux 6 ELS is not affected because the vulnerable code is not present. The Red Hat CVSS 3.1 base score of 5.5 (Moderate) reflects the availability-only impact over a local attack vector, but the flaw is rated LOW overall because triggering it requires local access, specific picoLCD hardware exposure, and an extreme loop count that appears theoretical.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.