CVE-2026-89628

A flaw was found in the Human Interface Device (HID) picolcd driver in the Linux kernel. A local attacker with root privileges, by using a specially crafted or spoofed picoLCD device, could exploit an out-of-bounds read vulnerability in the picolcd_debug_eeprom_read() function. This flaw occurs because the function trusts a device-supplied length without proper validation against the actual received data size. Successful exploitation could lead to the disclosure of sensitive information from adjacent kernel memory to userspace.

A moderate impact out-of-bounds read was fixed in the HID picolcd driver in the Linux kernel as shipped in Red Hat Enterprise Linux 7, 8, and 9 (kernel and kernel-rt) and in the Red Hat Enterprise Linux CoreOS (RHCOS) kernels used by OpenShift Container Platform 4. The picolcd_debug_eeprom_read() function trusted a length byte supplied by the device in its REPORT_EE_DATA reply without validating it against the number of bytes actually received, so a specially crafted or spoofed picoLCD device could make copy_to_user() read past the driver's receive buffer and disclose adjacent kernel slab memory to userspace through the debugfs "eeprom" file. That file is created root-only (S_IRUSR) and a crafted or spoofed picoLCD device is required, so the flaw is neither unprivileged- nor remotely-triggerable; the out-of-bounds access can also crash the kernel. Red Hat Enterprise Linux 6 Extended Lifecycle Support is not affected because the vulnerable code is not present in that stream. Red Hat rated this flaw Moderate impact (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting that exploitation requires an attacker who already has root privileges and controls a malicious HID device. Because the impact is Moderate and the CVSS score is below 7.0, fixes for the affected streams are deferred and no bug trackers are being filed; the residual risk is limited to local information disclosure from adjacent kernel memory or a kernel panic on systems where an attacker with root access attaches a crafted picoLCD device.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.