Out-of-bounds read in Linux kernel - CVE-2026-89628
Published: September 12, 2026
Vulnerability identifier: #VU149174
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89628
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in picolcd_debug_eeprom_read() when reading EEPROM data through the debugfs "eeprom" file. A local privileged user can use a crafted or spoofed picoLCD device to supply an oversized length value to disclose sensitive information.
The debugfs file is accessible only to root.
Affected software
Linux kernel
How to mitigate CVE-2026-89628
Install security update from vendor's repository.