{"id":"CVE-2026-80605","summary":"HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()\n\nIn picolcd_send_and_wait(), an integer overflow of the signed loop counter\n'k' can theoretically lead to a NULL pointer dereference of 'raw_data'.\nIf the loop executes more than INT_MAX times, 'k' becomes negative,\nmaking the condition 'k \u003c size' true even when 'size' is 0.\n\nChange the type of 'k' to 'unsigned int' to prevent the overflow and\neliminate the out-of-bounds access.\n\nFound by Linux Verification Center (linuxtesting.org) with the Svace static\nanalysis tool.\n\n[jkosina@suse.com: extended hash length]","modified":"2026-08-30T03:48:20.923925879Z","published":"2026-08-28T06:48:30.362Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80605.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0021eb09041f021c079be1022934a280f7f176c0"},{"type":"WEB","url":"https://git.kernel.org/stable/c/42dc0b7b55fe0499fc09183f34a1c46d1dcccf77"},{"type":"WEB","url":"https://git.kernel.org/stable/c/48caee2c106b03301c72fe389ebff00d852c58d5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a02d5d7ad7ae5fa3756b8332f7350e973085dcb3"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d354e523c6f740db758cafcd4c11bb7913285ed8"},{"type":"WEB","url":"https://git.kernel.org/stable/c/dc176447c7279435c46735db7da81aed1ec25cc2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e4edeefb8d5bfceb2058e2b3291f4ae1e5a76e61"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ef649703dce0df1364fcec3cdad9b32d1c522939"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80605.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80605"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"fabdbf2fd22fa170b4c5340dbdda5c8cd88fb205"},{"fixed":"42dc0b7b55fe0499fc09183f34a1c46d1dcccf77"},{"fixed":"48caee2c106b03301c72fe389ebff00d852c58d5"},{"fixed":"dc176447c7279435c46735db7da81aed1ec25cc2"},{"fixed":"a02d5d7ad7ae5fa3756b8332f7350e973085dcb3"},{"fixed":"e4edeefb8d5bfceb2058e2b3291f4ae1e5a76e61"},{"fixed":"d354e523c6f740db758cafcd4c11bb7913285ed8"},{"fixed":"ef649703dce0df1364fcec3cdad9b32d1c522939"},{"fixed":"0021eb09041f021c079be1022934a280f7f176c0"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80605.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.0"},{"fixed":"5.10.261"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.212"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.178"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.145"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.97"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.40"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80605.json"}}],"schema_version":"1.9.0"}