CVE-2026-89628 Overview
CVE-2026-89628 is an out-of-bounds read vulnerability in the Linux kernel's HID picoLCD driver (hid_picolcd). The flaw resides in picolcd_debug_eeprom_read(), which trusts a device-supplied length byte (resp->raw_data[2]) without validating it against resp->raw_size, the actual number of bytes copied into the 64-byte raw_data[] buffer of the struct picolcd_pending allocation. A malicious or spoofed picoLCD device returning a length byte of 0xff triggers copy_to_user() to read past the allocated slab object and leak adjacent kernel heap memory to userspace through the debugfs eeprom file.
Critical Impact
Kernel slab memory disclosure to userspace via the debugfs eeprom interface, enabling leakage of adjacent heap contents to a root-privileged reader when a crafted USB HID device is attached.
Affected Products
- Linux kernel builds with CONFIG_HID_PICOLCD and CONFIG_HID_PICOLCD_FB (debugfs support) enabled
- Multiple stable kernel branches, per the eight upstream fix commits referenced by the advisory
- Systems exposing the picoLCD debugfs eeprom node (created S_IRUSR, root-only)
Discovery Timeline
- 2026-09-11 - CVE-2026-89628 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89628
Vulnerability Analysis
The defect lives in drivers/hid/hid-picolcd_debugfs.c. When userspace reads the debugfs eeprom file, picolcd_debug_eeprom_read() issues a REPORT_EE_DATA request and receives a reply in a struct picolcd_pending object. The reply payload is stored in the fixed 64-byte raw_data[] field, with resp->raw_size recording how many bytes picolcd_raw_event() actually copied.
The read handler assigns the copy length directly from resp->raw_data[2], a device-controlled byte, clamping it only against the caller's count argument (s). It then calls copy_to_user(u, resp->raw_data + 3, ret) without checking resp->raw_size. A device that returns a length byte of 0xff combined with a user read() count of at least 255 causes copy_to_user() to read 255 bytes starting three bytes into a 64-byte buffer, walking past the object into adjacent slab memory.
KASAN reports this as a slab-out-of-bounds read of size 255 originating in picolcd_debug_eeprom_read+0x214/0x2f0 [hid_picolcd]. The neighboring debug-dump path already performs the missing size check; the read path did not.
Root Cause
The root cause is missing input validation [CWE-125 Out-of-Bounds Read] of an untrusted device-supplied length field. The driver treats the USB device as trusted for the value used to bound copy_to_user(), so a hostile device dictates the read length independent of the actual reply size.
Attack Vector
Exploitation requires two prerequisites: physical or virtual attachment of a crafted or spoofed picoLCD USB HID device, and a root-privileged process reading the debugfs node (the file is created with S_IRUSR permissions and debugfs itself is typically root-only). The flaw is therefore neither remotely nor unprivileged-triggerable, but it enables kernel heap disclosure that can aid subsequent local privilege-escalation chains.
The fix clamps the copy length to resp->raw_size - 3, floored at zero for short replies, so the driver never reads beyond the payload actually received from the device. Technical details are available in the upstream commits, including Kernel Git Commit 1a02056c and Kernel Git Commit 699a3c8b.
Detection Methods for CVE-2026-89628
Indicators of Compromise
- KASAN reports referencing slab-out-of-bounds in _copy_to_user with a call site in picolcd_debug_eeprom_read in the hid_picolcd module.
- Unexpected USB HID device enumerations advertising the picoLCD vendor/product identifiers on systems that do not use that hardware.
- Root processes opening /sys/kernel/debug/hid/*/eeprom on hosts where such access is not part of normal operations.
Detection Strategies
- Enable KASAN on test and canary kernels to catch out-of-bounds reads originating in the picoLCD driver during device fuzzing.
- Monitor kernel ring buffer messages (dmesg) for hid-picolcd warnings and slab boundary reports.
- Inventory loaded kernel modules and alert when hid_picolcd loads on systems that should not have picoLCD hardware attached.
Monitoring Recommendations
- Audit USB device attach events using udev or auditd rules to record vendor and product IDs for new HID devices.
- Track access to debugfs paths under /sys/kernel/debug/hid/ and treat unexpected reads as suspicious.
- Correlate kernel module load events with subsequent debugfs reads to surface the exploitation pattern.
How to Mitigate CVE-2026-89628
Immediate Actions Required
- Apply the upstream kernel patches referenced in the advisory to all affected stable branches as soon as vendor rebuilds are available.
- Unload the hid_picolcd module on systems that do not require picoLCD hardware using modprobe -r hid_picolcd and blacklist it via /etc/modprobe.d/.
- Restrict physical USB access on sensitive hosts and enforce USB device allowlisting where feasible.
Patch Information
The fix clamps the length used by copy_to_user() to resp->raw_size - 3, floored at zero, so the driver only exposes bytes actually received in the REPORT_EE_DATA reply. Backports are available across multiple stable branches; see the upstream commits including Kernel Git Commit 471f4a93, Kernel Git Commit 4daf432c, Kernel Git Commit 65daa322, Kernel Git Commit 8dc662af, Kernel Git Commit a3e6e8d7, and Kernel Git Commit e9c66739.
Workarounds
- Blacklist the hid_picolcd module on hosts without picoLCD hardware to prevent the driver from ever binding to an attached device.
- Disable or unmount debugfs (mount -o remount,ro /sys/kernel/debug or omit the mount entirely) on production systems where kernel debugging is not required.
- Enforce a USB device allowlist through kernel parameters or usbguard to block unauthorized HID devices from binding.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.