{"id":"CVE-2026-80605","title":"HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()\n\nIn picolcd_send_and_wait(), an integer overflow of the signed loop counter\n'k' can theoretica…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= fabdbf2fd22fa170b4c5340dbdda5c8cd88fb205 < 42dc0b7b55fe0499fc09183f34a1c46d1dcccf77","Linux >= fabdbf2fd22fa170b4c5340dbdda5c8cd88fb205 < 48caee2c106b03301c72fe389ebff00d852c58d5","Linux >= fabdbf2fd22fa170b4c5340dbdda5c8cd88fb205 < dc176447c7279435c46735db7da81aed1ec25cc2","Linux >= fabdbf2fd22fa170b4c5340dbdda5c8cd88fb205 < a02d5d7ad7ae5fa3756b8332f7350e973085dcb3","Linux >= fabdbf2fd22fa170b4c5340dbdda5c8cd88fb205 < e4edeefb8d5bfceb2058e2b3291f4ae1e5a76e61","Linux >= fabdbf2fd22fa170b4c5340dbdda5c8cd88fb205 < d354e523c6f740db758cafcd4c11bb7913285ed8","Linux >= fabdbf2fd22fa170b4c5340dbdda5c8cd88fb205 < ef649703dce0df1364fcec3cdad9b32d1c522939","Linux >= fabdbf2fd22fa170b4c5340dbdda5c8cd88fb205 < 0021eb09041f021c079be1022934a280f7f176c0","Linux 3.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T17:02:03.210731Z"},"published":"2026-08-28","updated":"2026-11-06","sourceUpdated":"2026-11-06T17:05:52.106Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80605","references":[{"url":"https://git.kernel.org/stable/c/42dc0b7b55fe0499fc09183f34a1c46d1dcccf77"},{"url":"https://git.kernel.org/stable/c/48caee2c106b03301c72fe389ebff00d852c58d5"},{"url":"https://git.kernel.org/stable/c/dc176447c7279435c46735db7da81aed1ec25cc2"},{"url":"https://git.kernel.org/stable/c/a02d5d7ad7ae5fa3756b8332f7350e973085dcb3"},{"url":"https://git.kernel.org/stable/c/e4edeefb8d5bfceb2058e2b3291f4ae1e5a76e61"},{"url":"https://git.kernel.org/stable/c/d354e523c6f740db758cafcd4c11bb7913285ed8"},{"url":"https://git.kernel.org/stable/c/ef649703dce0df1364fcec3cdad9b32d1c522939"},{"url":"https://git.kernel.org/stable/c/0021eb09041f021c079be1022934a280f7f176c0"}],"tags":["cve.org"],"epss":0.0022,"epssPercentile":0.1254,"ingestedAt":"2026-11-06T18:00:12.540Z","slug":"CVE-2026-80605","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nHID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()\n\nIn picolcd_send_and_wait(), an integer overflow of the signed loop counter\n'k' can theoretically lead to a NULL pointer dereference of 'raw_data'.\nIf the loop executes more than INT_MAX times, 'k' becomes negative,\nmaking the condition 'k < size' true even when 'size' is 0.\n\nChange the type of 'k' to 'unsigned int' to prevent the overflow and\neliminate the out-of-bounds access.\n\nFound by Linux Verification Center (linuxtesting.org) with the Svace static\nanalysis tool.\n\n[jkosina@suse.com: extended hash length]\n\n## Affected\n\n- `Linux >= fabdbf2fd22fa170b4c5340dbdda5c8cd88fb205 < 42dc0b7b55fe0499fc09183f34a1c46d1dcccf77`\n- `Linux >= fabdbf2fd22fa170b4c5340dbdda5c8cd88fb205 < 48caee2c106b03301c72fe389ebff00d852c58d5`\n- `Linux >= fabdbf2fd22fa170b4c5340dbdda5c8cd88fb205 < dc176447c7279435c46735db7da81aed1ec25cc2`\n- `Linux >= fabdbf2fd22fa170b4c5340dbdda5c8cd88fb205 < a02d5d7ad7ae5fa3756b8332f7350e973085dcb3`\n- `Linux >= fabdbf2fd22fa170b4c5340dbdda5c8cd88fb205 < e4edeefb8d5bfceb2058e2b3291f4ae1e5a76e61`\n- `Linux >= fabdbf2fd22fa170b4c5340dbdda5c8cd88fb205 < d354e523c6f740db758cafcd4c11bb7913285ed8`\n- `Linux >= fabdbf2fd22fa170b4c5340dbdda5c8cd88fb205 < ef649703dce0df1364fcec3cdad9b32d1c522939`\n- `Linux >= fabdbf2fd22fa170b4c5340dbdda5c8cd88fb205 < 0021eb09041f021c079be1022934a280f7f176c0`\n- `Linux 3.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}