CVE-2024-26994

What it actually does

The speakup driver in the Linux kernel fails to bound-check word length before copying into a fixed 256-byte buffer when rendering text on an unusually large console, allowing an out-of-bounds write that crashes the kernel.

Why it matters to the business

Systems relying on the speakup screen reader for accessibility can experience sudden kernel crashes and reboots when unusually long text lines appear on the console, interrupting operations on affected Linux installations.

How an attack unfolds

An attacker with the ability to write text to a console that uses speakup crafts or forces display of a string longer than 256 characters; the driver overflows its internal buffer, triggering a kernel panic.

How to fix it

Update the Linux kernel to a version containing commit 756c5cb7c09e537b87b5d3acafcb101b2ccf394f or later; rebuild and deploy the patched kernel across all affected systems.

How to confirm the fix worked

Verify the running kernel contains commit 756c5cb7c09e537b87b5d3acafcb101b2ccf394f via git log or kernel version string; test speakup with console lines longer than 256 characters to confirm no crash occurs.

Typical attack path

1. Gain local access or control over console output on a system using speakup
2. Cause a console line exceeding 256 characters to be rendered
3. Trigger the unbounded copy inside speakup's word-handling routine
4. Induce kernel crash and potential denial of service

How to detect it

Inspect kernel logs for oops or panic messages originating from speakup word buffer handling; correlate with processes writing long strings to affected consoles.

What your security team should do

• Apply the upstream fix or a distribution kernel update containing commit 756c5cb7c09e537b87b5d3acafcb101b2ccf394f as soon as possible
• Audit systems for speakup usage and disable the driver if accessibility features are not required
• Monitor kernel crash logs for speakup-related oopses as a temporary detection measure