UBUNTU-CVE-2026-89628: Medium severity ubuntu/linux vulnerability

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread() trusts resp->rawdata[2] -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read() count: ret = resp->rawdata[2]; if (ret > s) ret = s; if (copytouser(u, resp->rawdata+3, ret)) It never checks resp->rawsize, the number of bytes picolcdrawevent() actually copied into the 64-byte rawdata[] of the kmalloc'd struct picolcdpending. A device (or a spoofed picoLCD) returning a length byte of 0xff, read with a count >= 255, makes copytouser() read past rawdata[] into adjacent slab memory and return it to userspace through the debugfs "eeprom" file: BUG: KASAN: slab-out-of-bounds in copytouser Read of size 255 ... picolcddebugeepromread+0x214/0x2f0 [hidpicolcd] The debug-dump path in the same file already validates the device length byte against the received size before trusting it; this read does not. The file is created SIRUSR (root-only) and a crafted device is needed, so it is neither unprivileged- nor remotely-triggerable. Clamp the copy length to resp->rawsize - 3 (the payload actually received, minus the 3-byte header), floored at 0 for short replies.