Executive brief
The Linux kernel speakup accessibility module contains an out-of-bounds write vulnerability in its keyboard help system. A root user can override function names via sysfs with names starting with non-alphabetic characters, causing an array index to underflow or exceed bounds. This could lead to kernel memory corruption and system instability.
Technical details
The vulnerability is an out-of-bounds (OOB) write in the help_init() function within drivers/accessibility/speakup/keyhelp.c. The function builds a letter_offsets[] array by using the first byte of function names as an index via the expression (start & 31) - 1, where start is a character value. If function names are overridden from sysfs (accessible to root) with names starting outside the [a–z] range, the index calculation underflows or exceeds the array bounds, resulting in an OOB write. The attack requires root privilege and involves writing a specially crafted function name via /sys/accessibility/speakup/i18n/function_names followed by triggering the help system. The fix validates that the first letter is in the [a–z] range before using it as an index, preventing the out-of-bounds access.
Affected products
- Linux Linux kernel affected versions from c6e3fd22cd53 onwards; patched in commit 6a19ad4d68c95185308cd9e5d169b10a2cf236c8
Timeline
- 2026-09-17: disclosed
- 2026-06-01: patched: Upstream commit 6a19ad4d68c95185308cd9e5d169b10a2cf236c8