CVE-2026-93053

Summary

In the Linux kernel, the following vulnerability has been resolved:

speakup: keyhelp: guard letter_offsets possible out-of-range indexing

help_init() builds letter_offsets[] by using the first byte of each function name as an index via (start & 31) - 1. If function_names are overridden from sysfs (root) with a name starting outside [a–z], the index underflows or exceeds the array, leading to OOB write.

Function names can be overridden with the following commands as root:

modprobe speakup_soft
echo "0 _bad" > /sys/accessibility/speakup/i18n/function_names
# then press Insert+2 on /dev/tty

This fix checks the first letter in help_init(), and if it is not in the [a–z] range the function returns an error to the caller. Eventually this error is propagated to drivers/accessibility/speakup/main.c:2217, which causes a bleep sound.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxc6e3fd22cd538365bfeb82997d5b89562e077d42 < fd339b9ef0accb2c24a5285df842552ebf5eb146affected
LinuxLinuxc6e3fd22cd538365bfeb82997d5b89562e077d42 < 900cd6e5ef46bd15153762fb26bb03f874fccc52affected
LinuxLinuxc6e3fd22cd538365bfeb82997d5b89562e077d42 < 6b39969c724d39b6062efa354dc2d38442bfd021affected
LinuxLinuxc6e3fd22cd538365bfeb82997d5b89562e077d42 < 2e91ab73f9beb659f581e2a6a09f79ace1140905affected
LinuxLinuxc6e3fd22cd538365bfeb82997d5b89562e077d42 < d7deb90c4cd086cb111f0ecc9da021218fbde1b0affected
LinuxLinuxc6e3fd22cd538365bfeb82997d5b89562e077d42 < 5310334762c3f08f51dc2414344dd47492c07d1daffected
LinuxLinuxc6e3fd22cd538365bfeb82997d5b89562e077d42 < ca4489b3e54666a7cac7294e71a3cf64e5e95286affected
LinuxLinuxc6e3fd22cd538365bfeb82997d5b89562e077d42 < 6a19ad4d68c95185308cd9e5d169b10a2cf236c8affected
LinuxLinux2.6.37affected
LinuxLinux0 < 2.6.37unaffected
LinuxLinux5.10.270 <= 5.10.*unaffected
LinuxLinux5.15.221 <= 5.15.*unaffected
LinuxLinux6.1.188 <= 6.1.*unaffected
LinuxLinux6.6.157 <= 6.6.*unaffected
LinuxLinux6.12.110 <= 6.12.*unaffected
LinuxLinux6.18.52 <= 6.18.*unaffected
LinuxLinux7.2.6 <= 7.2.*unaffected
LinuxLinux7.3-rc1 <= *unaffected

Weaknesses

References