In the Linux kernel, the following vulnerability has been resolved:
speakup: keyhelp: guard letter_offsets possible out-of-range indexing
help_init() builds letter_offsets[] by using the first byte of each function name as an index via `(start & 31) - 1`. If function_names are overridden from sysfs (root) with a name starting outside [a–z], the index underflows or exceeds the array, leading to OOB write.
Function names can be overridden with the following commands as root:
modprobe speakup_soft echo "0 _bad" > /sys/accessibility/speakup/i18n/function_names # then press Insert+2 on /dev/tty
This fix checks the first letter in help_init(), and if it is not in the [a–z] range the function returns an error to the caller. Eventually this error is propagated to drivers/accessibility/speakup/main.c:2217, which causes a bleep sound.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linuxUpgrade linux-6.12 | Sep 30, 2026 | Sep 17, 2026 |
| Ubuntu | — | Upgrade linux-intel-iot-realtimeUpgrade linux-azure-fipsUpgrade linux-kvmUpgrade linux-oracleUpgrade linux-ibmUpgrade linux-awsUpgrade linux-gcp-fipsUpgrade linuxUpgrade linux-intel-iotg-5.15Upgrade linux-aws-fipsUpgrade linux-nvidiaUpgrade linux-azure-fdeUpgrade linux-oracle-5.15Upgrade linux-aws-5.15Upgrade linux-nvidia-tegraUpgrade linux-azureUpgrade linux-lowlatencyUpgrade linux-ibm-5.15Upgrade linux-realtimeUpgrade linux-riscvUpgrade linux-bluefieldUpgrade linux-riscv-5.15Upgrade linux-riscv-7.0Upgrade linux-hwe-5.15Upgrade linux-intel-iotgUpgrade linux-lowlatency-hwe-5.15Upgrade linux-fipsUpgrade linux-gkeUpgrade linux-oem-7.0Upgrade linux-nvidia-tegra-5.15Upgrade linux-azure-5.15Upgrade linux-nvidia-tegra-igxUpgrade linux-gkeopUpgrade linux-gcpUpgrade linux-azure-fde-5.15Upgrade linux-hwe-7.0Upgrade linux-gcp-5.15 | Nov 3, 2026 | Sep 17, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 30, 2026 | Sep 17, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub