A signed integer overflow in picolcd_send_and_wait() can cause the loop counter to become negative, causing the boundary check to succeed even when the data size is zero. This leads to a NULL pointer dereference of raw_data and causes a kernel crash, resulting in denial of service. The bug does not provide direct code execution.

All Linux kernel installations that include the HID picolcd driver before the commit that changes the loop counter type to unsigned int are affected. No specific kernel versions are listed, so any build containing the vulnerable code path is susceptible.

Based on the description, it is inferred that attackers would need local or physical access to a USB or HID device that triggers the picolcd driver. The EPSS score of <1% indicates a very low probability of exploitation. The CVSS score of 5.5 suggests moderate severity. The vulnerability can cause a NULL pointer dereference that leads to a kernel crash, resulting in denial of service. The flaw is exploitable only when the driver processes data from a picolcd device, so an attacker must have ability to supply such input.