CVE-2024-38587

speakup: Fix sizeof() vs ARRAY_SIZE() bug

State: Published
Severity: 7.8 High
Published: Jun 19, 2024
Updated: Oct 15, 2026
Reserved: Jun 18, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

speakup: Fix sizeof() vs ARRAY_SIZE() bug

The "buf" pointer is an array of u16 values. This code should be using ARRAY_SIZE() (which is 256) instead of sizeof() (which is 512), otherwise it can the still got out of bounds.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	756c5cb7c09e537b87b5d3acafcb101b2ccf394f to before 42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358Affected 8f6b62125befe1675446923e4171eac2c012959c to before cd7f3978c2ec741aedd1d860b2adb227314cf996Affected 6401038acfa24cba9c28cce410b7505efadd0222 to before 07ef95cc7a579731198c93beed281e3a79a0e586Affected 0d130158db29f5e0b3893154908cf618896450a8 to before 504178fb7d9f6cdb0496d5491efb05f45597e535Affected 89af25bd4b4bf6a71295f07e07a8ae7dc03c6595 to before 3726f75a1ccc16cd335c0ccfad1d92ee08ecba5eAffected 8defb1d22ba0395b81feb963b96e252b097ba76f to before c6e1650cf5df1bd6638eeee231a683ef30c7d4ebAffected 0efb15c14c493263cb3a5f65f5ddfd4603d19a76 to before eb1ea64328d4cc7d7a912c563f8523d5259716efAffected c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1 to before d52c04474feac8e305814a5228e622afe481b2efAffected c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1 to before 008ab3c53bc4f0b2f20013c8f6c204a3203d0b8bAffected 4.19.313 to before 4.19.316Affected 5.4.275 to before 5.4.278Affected 5.10.216 to before 5.10.219Affected 5.15.157 to before 5.15.161Affected 6.1.88 to before 6.1.93Affected 6.6.29 to before 6.6.33Affected 6.8.8 to before 6.8.12Affected
LinuxLinux	6.9Affected before 6.9Not affected 4.19.316 through 4.19.Not affected 5.4.278 through 5.4.Not affected 5.10.219 through 5.10.Not affected 5.15.161 through 5.15.Not affected 6.1.93 through 6.1.Not affected 6.6.33 through 6.6.Not affected 6.8.12 through 6.8.Not affected 6.9.3 through 6.9.Not affected 6.10 and laterNot affected

Product

Versions

LinuxLinux

756c5cb7c09e537b87b5d3acafcb101b2ccf394f to before 42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358Affected
8f6b62125befe1675446923e4171eac2c012959c to before cd7f3978c2ec741aedd1d860b2adb227314cf996Affected
6401038acfa24cba9c28cce410b7505efadd0222 to before 07ef95cc7a579731198c93beed281e3a79a0e586Affected
0d130158db29f5e0b3893154908cf618896450a8 to before 504178fb7d9f6cdb0496d5491efb05f45597e535Affected
89af25bd4b4bf6a71295f07e07a8ae7dc03c6595 to before 3726f75a1ccc16cd335c0ccfad1d92ee08ecba5eAffected
8defb1d22ba0395b81feb963b96e252b097ba76f to before c6e1650cf5df1bd6638eeee231a683ef30c7d4ebAffected
0efb15c14c493263cb3a5f65f5ddfd4603d19a76 to before eb1ea64328d4cc7d7a912c563f8523d5259716efAffected
c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1 to before d52c04474feac8e305814a5228e622afe481b2efAffected
c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1 to before 008ab3c53bc4f0b2f20013c8f6c204a3203d0b8bAffected
4.19.313 to before 4.19.316Affected
5.4.275 to before 5.4.278Affected
5.10.216 to before 5.10.219Affected
5.15.157 to before 5.15.161Affected
6.1.88 to before 6.1.93Affected
6.6.29 to before 6.6.33Affected
6.8.8 to before 6.8.12Affected

LinuxLinux

6.9Affected
before 6.9Not affected
4.19.316 through 4.19.*Not affected
5.4.278 through 5.4.*Not affected
5.10.219 through 5.10.*Not affected
5.15.161 through 5.15.*Not affected
6.1.93 through 6.1.*Not affected
6.6.33 through 6.6.*Not affected
6.8.12 through 6.8.*Not affected
6.9.3 through 6.9.*Not affected
6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.