CVE-2026-93053 speakup: keyhelp: guard letter_offsets possible out-of-range indexing
A local attacker with root privileges can trigger an out-of-bounds write in the Linux kernel speakup module by overriding function names via sysfs, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-93053?
CVE-2026-93053 is a memory corruption vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
speakup: keyhelp: guard letter_offsets possible out-of-range indexing
help_init() builds letter_offsets[] by using the first byte of each function name as an index via `(start & 31) - 1`. If function_names are overridden from sysfs (root) with a name starting outside [a–z], the index underflows or exceeds the array, leading to OOB write.
Function names can be overridden with the following commands as root:
modprobe speakup_soft echo "0 _bad" > /sys/accessibility/speakup/i18n/function_names # then press Insert+2 on /dev/tty
This fix checks the first letter in help_init(), and if it is not in the [a–z] range the function returns an error to the caller. Eventually this error is propagated to drivers/accessibility/speakup/main.c:2217, which causes a bleep sound.
Which versions are affected by CVE-2026-93053?
How do I fix CVE-2026-93053?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-93053 being exploited?
There is no known exploitation of CVE-2026-93053 in the wild and no public exploit code.
Sources
Also known as AZL-103004, BELL-CVE-2026-93053, DEBIAN-CVE-2026-93053, GHSA-wqw9-pm7j-m5rf, UBUNTU-CVE-2026-93053.