In Linux kernel versions that include the hid_picolcd driver, the eeprom debugfs read path trusts a length byte supplied by the pico data actually received. This represents a CWE-805: Buffer Copy without Checking Size vulnerability. The driver copies this potentially oversized value into a user buffer and then performs a copy_to_user of that many bytes. If the device reports a length of 0xff and the read count is at least 255 bytes, the kernel will read past its buffer, leaking contiguous slab memory through the debugfs file. Because the debugfs file is owned with root-only permissions, an attacker must already have root privileges and supply a fabricated length byte, so no privilege escalation or remote exploitation is possible beyond information disclosure.

Any Linux kernel release that shipped the vulnerable hid_picolcd driver before the fix is affected. The vendor is enumerated, so any kernel containing the unpatched driver may be compromised.

The CVSS score of 5.4 reflects a medium‑severity local exploitation scenario. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker must already have root and supply a fabricated length byte. Under these stringent conditions, the kernel will leak contiguous slab memory through the debugfs file that only root can read. The consequence is limited to information disclosure for an already‑privileged user and does not grant remote access or privilege escalation.