CVE-2026-93053
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
speakup: keyhelp: guard letter_offsets possible out-of-range indexing
In the Linux kernel, the following vulnerability has been resolved: speakup: keyhelp: guard letter_offsets possible out-of-range indexing help_init() builds letter_offsets[] by using the first byte of each function name as an index via `(start & 31) - 1`. If function_names are overridden from sysfs (root) with a name starting outside [a–z], the index underflows or exceeds the array, leading to OOB write. Function names can be overridden with the following commands as root: modprobe speakup_soft echo "0 _bad" > /sys/accessibility/speakup/i18n/function_names # then press Insert+2 on /dev/tty This fix checks the first letter in help_init(), and if it is not in the [a–z] range the function returns an error to the caller. Eventually this error is propagated to drivers/accessibility/speakup/main.c:2217, which causes a bleep sound.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| c6e3fd22cd538365bfeb82997d5b89562e077d42 | affected | git | fd339b9ef0accb2c24a5285df842552ebf5eb146 | Unavailable | None listed |
| c6e3fd22cd538365bfeb82997d5b89562e077d42 | affected | git | 900cd6e5ef46bd15153762fb26bb03f874fccc52 | Unavailable | None listed |
| c6e3fd22cd538365bfeb82997d5b89562e077d42 | affected | git | 6b39969c724d39b6062efa354dc2d38442bfd021 | Unavailable | None listed |
| c6e3fd22cd538365bfeb82997d5b89562e077d42 | affected | git | 2e91ab73f9beb659f581e2a6a09f79ace1140905 | Unavailable | None listed |
| c6e3fd22cd538365bfeb82997d5b89562e077d42 | affected | git | d7deb90c4cd086cb111f0ecc9da021218fbde1b0 | Unavailable | None listed |
| c6e3fd22cd538365bfeb82997d5b89562e077d42 | affected | git | 5310334762c3f08f51dc2414344dd47492c07d1d | Unavailable | None listed |
| c6e3fd22cd538365bfeb82997d5b89562e077d42 | affected | git | ca4489b3e54666a7cac7294e71a3cf64e5e95286 | Unavailable | None listed |
| c6e3fd22cd538365bfeb82997d5b89562e077d42 | affected | git | 6a19ad4d68c95185308cd9e5d169b10a2cf236c8 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 2.6.37 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 2.6.37 | Unavailable | None listed |
| 5.10.270 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.221 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.188 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.157 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.110 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.52 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.2.6 | unaffected | semver | Unavailable | 7.2.* | None listed |
| 7.3 | unaffected | original_commit_for_fix | Unavailable | * | None listed |