CVE-2026-93053

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

speakup: keyhelp: guard letter_offsets possible out-of-range indexing

help_init() builds letter_offsets[] by using the first byte of each

function name as an index via `(start & 31) - 1`. If function_names are

overridden from sysfs (root) with a name starting outside [a–z], the

index underflows or exceeds the array, leading to OOB write.

Function names can be overridden with the following commands as root:

modprobe speakup_soft

echo "0 _bad" > /sys/accessibility/speakup/i18n/function_names

# then press Insert+2 on /dev/tty

This fix checks the first letter in help_init(), and if it is not in the

[a–z] range the function returns an error to the caller. Eventually this

error is propagated to drivers/accessibility/speakup/main.c:2217, which

causes a bleep sound.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References