Cloudanix VulnDB

CVE-2026-93053

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A configuration change made by an administrator on certain Linux systems could accidentally damage memory inside the kernel and cause crashes or instability.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Out-of-bounds write in speakup keyhelp module when letter_offsets[] is indexed via (first_byte & 31) - 1 after root overrides function_names via sysfs with a character outside [a-z], causing underflow or overflow.

Why it matters to the business

Kernel memory corruption risk on Linux systems using the speakup accessibility driver; exploitation requires root privileges and yields low real-world impact given absence from KEV, ransomware campaigns, and flat low EPSS with no upward trend.

How an attack unfolds

Root user loads speakup_soft, writes an out-of-range first character into /sys/accessibility/speakup/i18n/function_names, then triggers Insert+2 on tty to invoke help_init() and trigger the unsafe indexing leading to OOB write.

How to fix it

Apply upstream kernel patch that adds range check in help_init() returning error on invalid first letter; upgrade to a kernel containing the fix once released; restrict write access to speakup sysfs entries where operationally feasible.

How to confirm the fix worked

Confirm kernel source contains the added first-letter range validation in help_init(); attempt the documented sysfs override with out-of-range character and verify error is returned without OOB access; monitor dmesg for bleep on tty after fix.

Typical attack path

  1. Obtain root on target Linux system
  2. modprobe speakup_soft
  3. echo invalid first-byte name into /sys/accessibility/speakup/i18n/function_names
  4. Trigger help via Insert+2 keystroke on /dev/tty
  5. OOB write occurs during help_init() array indexing

How to detect it

Search auth logs and command history for modprobe speakup_soft followed by echo writes containing non-letter first characters to /sys/accessibility/speakup/i18n/function_names; inspect kernel logs for speakup help_init errors or unexpected bleeps on tty after such activity.

  • modprobe speakup_soft
  • echo "0 _bad" > /sys/accessibility/speakup/i18n/function_names
  • /sys/accessibility/speakup/i18n/function_names

What your security team should do

  • Prioritize kernel upgrade on any system exposing speakup sysfs interfaces
  • Audit and limit root-level writes to /sys/accessibility/speakup/*
  • Monitor EPSS and KEV status for future changes given 37 days since publication
  • Test accessibility workflows after applying the range-check patch

The record

In the Linux kernel, the following vulnerability has been resolved: speakup: keyhelp: guard letter_offsets possible out-of-range indexing help_init() builds letter_offsets[] by using the first byte of each function name as an index via `(start & 31) - 1`. If function_names are overridden from sysfs (root) with a name starting outside [a–z], the index underflows or exceeds the array, leading to OOB write. Function names can be overridden with the following commands as root: modprobe speakup_soft echo "0 _bad" > /sys/accessibility/speakup/i18n/function_names # then press Insert+2 on /dev/tty This fix checks the first letter in help_init(), and if it is not in the [a–z] range the function returns an error to the caller. Eventually this error is propagated to drivers/accessibility/speakup/main.c:2217, which causes a bleep sound.

Affected packages

Ecosystem Package Introduced Fixed