HIGH Introduced in 2.6.37
speakup LetterOffsets OOB
CVE-2026-93053
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: speakup: keyhelp: guard letter_offsets possible out-of-range indexing help_init() builds letter_offsets[] by using the first byte of each function name as an index via `(start & 31) - 1`. If function_names are overridden from sysfs (root) with a name starting outside [a–z], the index underflows or exceeds the array, leading to OOB write. Function names can be overridden with the following commands as root: modprobe speakup_soft echo "0 _bad" > /sys/accessibility/speakup/i18n/function_names # then press Insert+2 on /dev/tty This fix checks the first letter in help_init(), and if it is not in the [a–z] range the function returns an error to the caller. Eventually this error is propagated to drivers/accessibility/speakup/main.c:2217, which causes a bleep sound.
02KernelScan AI Analysis
Risk summary
A root user on a system with the speakup accessibility module loaded can overwrite a kernel array out of bounds by supplying a crafted function name via sysfs and then triggering the help key combination on the console. This can corrupt kernel memory and potentially crash the system. The attack requires both root privileges and console access, limiting exposure to systems where the speakup module is intentionally loaded.
Vulnerability analysis
The speakup screen-reader subsystem builds an internal lookup array by using the first character of each function name as an index, assuming the name always starts with a lowercase letter. When function names are overridden through the sysfs interface with a name beginning outside the expected range, the index computation underflows or overshoots the array, producing an out-of-bounds write into kernel memory. The fix validates that the first letter falls within the accepted range before using it as an index, skipping any entry that does not. The vulnerable path is reachable only by a user with root privileges who can write to the speakup sysfs attributes and who has access to the physical console to trigger the help key sequence, and only when the speakup module is loaded.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 2.6.37 | 5.10.270 | fd339b9ef0ac |
| 5.15 | 2.6.37 | 5.15.221 | 900cd6e5ef46 |
| 6.1 | 2.6.37 | 6.1.188 | 6b39969c724d |
| 6.12 | 2.6.37 | 6.12.110 | d7deb90c4cd0 |
| 6.18 | 2.6.37 | 6.18.52 | 5310334762c3 |
| 6.6 | 2.6.37 | 6.6.157 | 2e91ab73f9be |
| 7.2 | 2.6.37 | 7.2.6 | ca4489b3e546 |
| mainline | 2.6.37 | 7.3 | 6a19ad4d68c9 |
| cip/5.10 | 2.6.37 | 5.10.271-cip78 | fd339b9ef0ac |
| cip/6.1 | 2.6.37 | 6.1.189-cip61 | 6b39969c724d |
| cip/6.1-rt | 2.6.37 | 6.1.189-cip61-rt32 | 6b39969c724d |
| cip/6.12 | 2.6.37 | 6.12.111-cip32 | d7deb90c4cd0 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |