CVE-2026-80605

Description

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() In picolcd_send_and_wait(), an integer overflow of the signed loop counter 'k' can theoretically lead to a NULL pointer dereference of 'raw_data'. If the loop executes more than INT_MAX times, 'k' becomes negative, making the condition 'k < size' true even when 'size' is 0. Change the type of 'k' to 'unsigned int' to prevent the overflow and eliminate the out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool. [[email protected]: extended hash length]

Is your site exposed to CVE-2026-80605?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0018

Probability of exploitation

0.07%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/0021eb09041f021c079be1022934a280f7f176c0 https://git.kernel.org/stable/c/42dc0b7b55fe0499fc09183f34a1c46d1dcccf77 https://git.kernel.org/stable/c/48caee2c106b03301c72fe389ebff00d852c58d5 https://git.kernel.org/stable/c/a02d5d7ad7ae5fa3756b8332f7350e973085dcb3 https://git.kernel.org/stable/c/d354e523c6f740db758cafcd4c11bb7913285ed8 https://git.kernel.org/stable/c/dc176447c7279435c46735db7da81aed1ec25cc2 https://git.kernel.org/stable/c/e4edeefb8d5bfceb2058e2b3291f4ae1e5a76e61 https://git.kernel.org/stable/c/ef649703dce0df1364fcec3cdad9b32d1c522939

Frequently Asked Questions

What is CVE-2026-80605? +

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() In picolcd_send_and_wait(), an integer overflow of the signed loop counter 'k' can theoretically lead to a NULL pointer dereference of 'raw_data'. If the loop executes more than INT_MAX times, 'k' becomes negative, making the condition 'k < size' true even when 'size' is 0. Change the type of 'k' to 'unsigned int' to prevent the overflow and eliminate the out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool. [[email protected]: extended hash length]

How do I check if I'm vulnerable to CVE-2026-80605? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.