CVE-2026-93053

speakup: keyhelp: guard letter_offsets possible out-of-range indexing

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

speakup: keyhelp: guard letter_offsets possible out-of-range indexing

help_init() builds letter_offsets[] by using the first byte of each function name as an index via `(start & 31) - 1`. If function_names are overridden from sysfs (root) with a name starting outside [a–z], the index underflows or exceeds the array, leading to OOB write.

Function names can be overridden with the following commands as root:

modprobe speakup_soft echo "0 _bad" > /sys/accessibility/speakup/i18n/function_names # then press Insert+2 on /dev/tty

This fix checks the first letter in help_init(), and if it is not in the [a–z] range the function returns an error to the caller. Eventually this error is propagated to drivers/accessibility/speakup/main.c:2217, which causes a bleep sound.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c6e3fd22cd538365bfeb82997d5b89562e077d42 to before fd339b9ef0accb2c24a5285df842552ebf5eb146Affected c6e3fd22cd538365bfeb82997d5b89562e077d42 to before 900cd6e5ef46bd15153762fb26bb03f874fccc52Affected c6e3fd22cd538365bfeb82997d5b89562e077d42 to before 6b39969c724d39b6062efa354dc2d38442bfd021Affected c6e3fd22cd538365bfeb82997d5b89562e077d42 to before 2e91ab73f9beb659f581e2a6a09f79ace1140905Affected c6e3fd22cd538365bfeb82997d5b89562e077d42 to before d7deb90c4cd086cb111f0ecc9da021218fbde1b0Affected c6e3fd22cd538365bfeb82997d5b89562e077d42 to before 5310334762c3f08f51dc2414344dd47492c07d1dAffected c6e3fd22cd538365bfeb82997d5b89562e077d42 to before ca4489b3e54666a7cac7294e71a3cf64e5e95286Affected c6e3fd22cd538365bfeb82997d5b89562e077d42 to before 6a19ad4d68c95185308cd9e5d169b10a2cf236c8Affected
LinuxLinux	2.6.37Affected before 2.6.37Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

c6e3fd22cd538365bfeb82997d5b89562e077d42 to before fd339b9ef0accb2c24a5285df842552ebf5eb146Affected
c6e3fd22cd538365bfeb82997d5b89562e077d42 to before 900cd6e5ef46bd15153762fb26bb03f874fccc52Affected
c6e3fd22cd538365bfeb82997d5b89562e077d42 to before 6b39969c724d39b6062efa354dc2d38442bfd021Affected
c6e3fd22cd538365bfeb82997d5b89562e077d42 to before 2e91ab73f9beb659f581e2a6a09f79ace1140905Affected
c6e3fd22cd538365bfeb82997d5b89562e077d42 to before d7deb90c4cd086cb111f0ecc9da021218fbde1b0Affected
c6e3fd22cd538365bfeb82997d5b89562e077d42 to before 5310334762c3f08f51dc2414344dd47492c07d1dAffected
c6e3fd22cd538365bfeb82997d5b89562e077d42 to before ca4489b3e54666a7cac7294e71a3cf64e5e95286Affected
c6e3fd22cd538365bfeb82997d5b89562e077d42 to before 6a19ad4d68c95185308cd9e5d169b10a2cf236c8Affected

LinuxLinux

2.6.37Affected
before 2.6.37Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.