In Linux kernel versions that include the hid_picolcd driver, the eeprom debugfs read path trusts a length byte supplied by the pico data actually received. This represents a CWE-805: Buffer Copy without Checking Size vulnerability. The driver copies this potentially oversized value into a user buffer and then performs a copy_to_user of that many bytes. If the device reports a length of 0xff and the read count is at least 255,‑byte buffer, causing a kernel memory leak. Because the debugfs file is owned with root‑only permissions, privileged user and does not provide a privilege escalation path.

Any Linux kernel release that shipped the vulnerable hid_picolcd driver before the fix is affected. The vendor is enumerated, so any kernel containing the unpatched driver may be compromised.

The CVSS score of 5.4 reflects a medium‑severity local exploitation scenario. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker must already have root and supply a fabricated length byte. Under these stringent conditions, the kernel will leak contiguous slab memory through the debugfs file that only root can read. The consequence is limited to information disclosure for an already‑privileged user and does not grant remote access or privilege escalation.