GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-26994 (GCVE-0-2024-26994)

Vulnerability from cvelistv5 – Published: 2024-05-01 05:28 – Updated: 2026-08-05 11:28
VLAI
Title
speakup: Avoid crash on very long word
Summary
In the Linux kernel, the following vulnerability has been resolved: speakup: Avoid crash on very long word In case a console is set up really large and contains a really long word (> 256 characters), we have to stop before the length of the word buffer.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.9 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-17 14:52 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c6e3fd22cd538365bfeb82997d5b89562e077d42 , < 756c5cb7c09e537b87b5d3acafcb101b2ccf394f (git)
Affected: c6e3fd22cd538365bfeb82997d5b89562e077d42 , < 8f6b62125befe1675446923e4171eac2c012959c (git)
Affected: c6e3fd22cd538365bfeb82997d5b89562e077d42 , < 6401038acfa24cba9c28cce410b7505efadd0222 (git)
Affected: c6e3fd22cd538365bfeb82997d5b89562e077d42 , < 0d130158db29f5e0b3893154908cf618896450a8 (git)
Affected: c6e3fd22cd538365bfeb82997d5b89562e077d42 , < 89af25bd4b4bf6a71295f07e07a8ae7dc03c6595 (git)
Affected: c6e3fd22cd538365bfeb82997d5b89562e077d42 , < 8defb1d22ba0395b81feb963b96e252b097ba76f (git)
Affected: c6e3fd22cd538365bfeb82997d5b89562e077d42 , < 0efb15c14c493263cb3a5f65f5ddfd4603d19a76 (git)
Affected: c6e3fd22cd538365bfeb82997d5b89562e077d42 , < c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.37
Unaffected: 0 , < 2.6.37 (semver)
Unaffected: 4.19.313 , ≤ 4.19.* (semver)
Unaffected: 5.4.275 , ≤ 5.4.* (semver)
Unaffected: 5.10.216 , ≤ 5.10.* (semver)
Unaffected: 5.15.157 , ≤ 5.15.* (semver)
Unaffected: 6.1.88 , ≤ 6.1.* (semver)
Unaffected: 6.6.29 , ≤ 6.6.* (semver)
Unaffected: 6.8.8 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "LOW",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-26994",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-17T14:52:12.815212Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-04T16:48:53.206Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:15:52.431Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/756c5cb7c09e537b87b5d3acafcb101b2ccf394f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8f6b62125befe1675446923e4171eac2c012959c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6401038acfa24cba9c28cce410b7505efadd0222"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0d130158db29f5e0b3893154908cf618896450a8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/89af25bd4b4bf6a71295f07e07a8ae7dc03c6595"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8defb1d22ba0395b81feb963b96e252b097ba76f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0efb15c14c493263cb3a5f65f5ddfd4603d19a76"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/accessibility/speakup/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "756c5cb7c09e537b87b5d3acafcb101b2ccf394f",
              "status": "affected",
              "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
              "versionType": "git"
            },
            {
              "lessThan": "8f6b62125befe1675446923e4171eac2c012959c",
              "status": "affected",
              "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
              "versionType": "git"
            },
            {
              "lessThan": "6401038acfa24cba9c28cce410b7505efadd0222",
              "status": "affected",
              "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
              "versionType": "git"
            },
            {
              "lessThan": "0d130158db29f5e0b3893154908cf618896450a8",
              "status": "affected",
              "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
              "versionType": "git"
            },
            {
              "lessThan": "89af25bd4b4bf6a71295f07e07a8ae7dc03c6595",
              "status": "affected",
              "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
              "versionType": "git"
            },
            {
              "lessThan": "8defb1d22ba0395b81feb963b96e252b097ba76f",
              "status": "affected",
              "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
              "versionType": "git"
            },
            {
              "lessThan": "0efb15c14c493263cb3a5f65f5ddfd4603d19a76",
              "status": "affected",
              "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
              "versionType": "git"
            },
            {
              "lessThan": "c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1",
              "status": "affected",
              "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/accessibility/speakup/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.37"
            },
            {
              "lessThan": "2.6.37",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.313",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.275",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.313",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.275",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.216",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.157",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.88",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.29",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.8",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspeakup: Avoid crash on very long word\n\nIn case a console is set up really large and contains a really long word\n(\u003e 256 characters), we have to stop before the length of the word buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is reached only through the speakup console screen-reader command path (`keyboard_notifier_call` \u2192 `speakup_key` \u2192 `do_spkup` \u2192 `get_word`) combined with `VT_RESIZE`/`PIO_UNIMAP`/`KDFONTOP` ioctls on the attacker\u0027s own virtual console, all of which require a local session on the machine. There is no network or remote protocol handler involved, but console/VT access is standard local access rather than physical device attachment.\nAC:L - Every precondition is under the attacker\u0027s control: `vt_ioctl()` grants `perm=1` to the tty owner, so an unprivileged console user can `VT_RESIZE` the console past 257 columns (up to `VC_MAXCOL`=32767 outright when the VC is bound to dummycon, which has no `con_resize` clamp, or via a narrow `KDFONTOP` font under fbcon), then print a \u003e256-character word and press the say-word key. No race, no memory-layout luck, and on 4K framebuffer consoles the stock 8x16 font already yields 480 columns by default.\nPR:L - The attacker needs an ordinary unprivileged local account owning a virtual console \u2014 `current-\u003esignal-\u003etty == tty` alone satisfies the VT ioctl permission check, so no CAP_SYS_TTY_CONFIG or root is required, and `do_spkup()` performs no capability check before invoking `get_word()`.\nUI:N - The attacker performs every step themselves \u2014 resizing their own VT, loading the unimap, painting the long word, and issuing the speakup say-word/spell-word command; no separate victim needs to be induced into any action.\nS:U - The out-of-bounds write corrupts kernel `.bss` belonging to the same kernel security authority that contains the vulnerable code; no VM, hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The linear overflow lands on `spk_characters[256]`, a pointer array immediately following `buf` in `.bss`, whose entries are dereferenced and printed via `synth_printf(\"%s\", cp)` into the synth buffer that userspace reads from `/dev/softsynth` \u2014 giving an arbitrary kernel-memory read primitive disclosed to the attacker, well beyond a bounded leak.\nI:H - This is an out-of-bounds write of fully attacker-chosen 16-bit values (sourced from an attacker-loaded `inverse_trans_unicode` table) with attacker-chosen length, overwriting adjacent `.bss` pointer arrays such as `spk_our_keys[]` and `speakup_console[]`, the latter being dereferenced for writes (`speakup_console[vc_num]-\u003eht.highbuf[bi][hi] = ic[i]`) \u2014 an arbitrary-write and control-flow-influence primitive.\nA:H - Even without careful exploitation, smashing kilobytes of `.bss` past `buf[256]` corrupts live pointer arrays that speakup dereferences on the next key event, producing an immediate kernel oops/panic \u2014 the crash the commit title explicitly refers to."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:53.774Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/756c5cb7c09e537b87b5d3acafcb101b2ccf394f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f6b62125befe1675446923e4171eac2c012959c"
        },
        {
          "url": "https://git.kernel.org/stable/c/6401038acfa24cba9c28cce410b7505efadd0222"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d130158db29f5e0b3893154908cf618896450a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/89af25bd4b4bf6a71295f07e07a8ae7dc03c6595"
        },
        {
          "url": "https://git.kernel.org/stable/c/8defb1d22ba0395b81feb963b96e252b097ba76f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0efb15c14c493263cb3a5f65f5ddfd4603d19a76"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1"
        }
      ],
      "title": "speakup: Avoid crash on very long word",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26994",
    "datePublished": "2024-05-01T05:28:07.350Z",
    "dateReserved": "2024-02-19T14:20:24.206Z",
    "dateUpdated": "2026-08-05T11:28:53.774Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26994",
      "date": "2026-09-19",
      "epss": "0.00295",
      "percentile": "0.22334"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspeakup: Avoid crash on very long word\n\nIn case a console is set up really large and contains a really long word\n(\u003e 256 characters), we have to stop before the length of the word buffer."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux se ha solucionado la siguiente vulnerabilidad: Speakup: Evitar crash en palabras muy largas En caso de que una consola est\u00e9 configurada muy grande y contenga una palabra muy larga (\u0026gt;256 caracteres), tenemos que detenernos antes de la longitud de la palabra. b\u00fafer de palabras."
        }
      ],
      "id": "CVE-2024-26994",
      "lastModified": "2024-11-21T09:03:34.623",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "LOW",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            },
            "exploitabilityScore": 2.5,
            "impactScore": 3.4,
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-05-01T06:15:17.207",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/0d130158db29f5e0b3893154908cf618896450a8"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/0efb15c14c493263cb3a5f65f5ddfd4603d19a76"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/6401038acfa24cba9c28cce410b7505efadd0222"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/756c5cb7c09e537b87b5d3acafcb101b2ccf394f"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/89af25bd4b4bf6a71295f07e07a8ae7dc03c6595"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/8defb1d22ba0395b81feb963b96e252b097ba76f"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/8f6b62125befe1675446923e4171eac2c012959c"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/0d130158db29f5e0b3893154908cf618896450a8"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/0efb15c14c493263cb3a5f65f5ddfd4603d19a76"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/6401038acfa24cba9c28cce410b7505efadd0222"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/756c5cb7c09e537b87b5d3acafcb101b2ccf394f"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/89af25bd4b4bf6a71295f07e07a8ae7dc03c6595"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/8defb1d22ba0395b81feb963b96e252b097ba76f"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/8f6b62125befe1675446923e4171eac2c012959c"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/accessibility/speakup/main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "756c5cb7c09e537b87b5d3acafcb101b2ccf394f",
                    "status": "affected",
                    "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8f6b62125befe1675446923e4171eac2c012959c",
                    "status": "affected",
                    "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6401038acfa24cba9c28cce410b7505efadd0222",
                    "status": "affected",
                    "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0d130158db29f5e0b3893154908cf618896450a8",
                    "status": "affected",
                    "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "89af25bd4b4bf6a71295f07e07a8ae7dc03c6595",
                    "status": "affected",
                    "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8defb1d22ba0395b81feb963b96e252b097ba76f",
                    "status": "affected",
                    "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0efb15c14c493263cb3a5f65f5ddfd4603d19a76",
                    "status": "affected",
                    "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1",
                    "status": "affected",
                    "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/accessibility/speakup/main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.37"
                  },
                  {
                    "lessThan": "2.6.37",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.313",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.275",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.88",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.29",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.8.*",
                    "status": "unaffected",
                    "version": "6.8.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.9",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CAC6303F-664F-49A4-A2BD-9AFFA0ED2DEA",
                    "versionEndExcluding": "4.19.313",
                    "versionStartIncluding": "2.6.37",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5FF6D8DE-C559-4586-86C8-2C6B4420A2C2",
                    "versionEndExcluding": "5.4.275",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A44ABF89-F1BD-4C9A-895D-7596650DCD27",
                    "versionEndExcluding": "5.10.216",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C67E2ABA-9F30-4CE6-A840-B1051D07E0CF",
                    "versionEndExcluding": "5.15.157",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B665F958-644E-434D-A78D-CCD1628D1774",
                    "versionEndExcluding": "6.1.88",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0999E154-1E68-41FA-8DE3-9A735E382224",
                    "versionEndExcluding": "6.6.29",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "673B3328-389D-41A4-9617-669298635262",
                    "versionEndExcluding": "6.8.8",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "A06B2CCF-3F43-4FA9-8773-C83C3F5764B2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CA277A6C-83EC-4536-9125-97B84C4FAF59",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspeakup: Avoid crash on very long word\n\nIn case a console is set up really large and contains a really long word\n(\u003e 256 characters), we have to stop before the length of the word buffer."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux se ha solucionado la siguiente vulnerabilidad: Speakup: Evitar crash en palabras muy largas En caso de que una consola est\u00e9 configurada muy grande y contenga una palabra muy larga (\u0026gt;256 caracteres), tenemos que detenernos antes de la longitud de la palabra. b\u00fafer de palabras."
          }
        ],
        "id": "CVE-2024-26994",
        "lastModified": "2026-08-04T11:17:31.740",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 3.4,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-26994",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-17T14:52:12.815212Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-01T06:15:17.207",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0d130158db29f5e0b3893154908cf618896450a8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0efb15c14c493263cb3a5f65f5ddfd4603d19a76"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6401038acfa24cba9c28cce410b7505efadd0222"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/756c5cb7c09e537b87b5d3acafcb101b2ccf394f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/89af25bd4b4bf6a71295f07e07a8ae7dc03c6595"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8defb1d22ba0395b81feb963b96e252b097ba76f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8f6b62125befe1675446923e4171eac2c012959c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0d130158db29f5e0b3893154908cf618896450a8"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0efb15c14c493263cb3a5f65f5ddfd4603d19a76"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6401038acfa24cba9c28cce410b7505efadd0222"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/756c5cb7c09e537b87b5d3acafcb101b2ccf394f"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/89af25bd4b4bf6a71295f07e07a8ae7dc03c6595"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8defb1d22ba0395b81feb963b96e252b097ba76f"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8f6b62125befe1675446923e4171eac2c012959c"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T14:36:39+00:00",
      "cve": "CVE-2024-26994",
      "id": "CVE-2024-26994",
      "initial_release_date": "2024-05-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: speakup: Avoid crash on very long word",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26994.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:25:48Z",
      "cve": "CVE-2024-26994",
      "id": "CVE-2024-26994",
      "initial_release_date": "2024-05-03T02:09:41Z",
      "product_status:known_affected": "321",
      "product_status:known_not_affected": "264",
      "product_status:recommended": "670",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26994",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26994.json",
      "version": "93"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-04T17:15:52.431Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/756c5cb7c09e537b87b5d3acafcb101b2ccf394f"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/8f6b62125befe1675446923e4171eac2c012959c"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/6401038acfa24cba9c28cce410b7505efadd0222"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/0d130158db29f5e0b3893154908cf618896450a8"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/89af25bd4b4bf6a71295f07e07a8ae7dc03c6595"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/8defb1d22ba0395b81feb963b96e252b097ba76f"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/0efb15c14c493263cb3a5f65f5ddfd4603d19a76"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
              },
              {
                "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
              },
              {
                "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
              },
              {
                "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "LOW",
                  "baseScore": 5.9,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "LOW",
                  "integrityImpact": "LOW",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-26994",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-07-17T14:52:12.815212Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "description": "CWE-noinfo Not enough information",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-07-17T14:52:22.353Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/accessibility/speakup/main.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "756c5cb7c09e537b87b5d3acafcb101b2ccf394f",
                  "status": "affected",
                  "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
                  "versionType": "git"
                },
                {
                  "lessThan": "8f6b62125befe1675446923e4171eac2c012959c",
                  "status": "affected",
                  "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
                  "versionType": "git"
                },
                {
                  "lessThan": "6401038acfa24cba9c28cce410b7505efadd0222",
                  "status": "affected",
                  "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
                  "versionType": "git"
                },
                {
                  "lessThan": "0d130158db29f5e0b3893154908cf618896450a8",
                  "status": "affected",
                  "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
                  "versionType": "git"
                },
                {
                  "lessThan": "89af25bd4b4bf6a71295f07e07a8ae7dc03c6595",
                  "status": "affected",
                  "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
                  "versionType": "git"
                },
                {
                  "lessThan": "8defb1d22ba0395b81feb963b96e252b097ba76f",
                  "status": "affected",
                  "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
                  "versionType": "git"
                },
                {
                  "lessThan": "0efb15c14c493263cb3a5f65f5ddfd4603d19a76",
                  "status": "affected",
                  "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
                  "versionType": "git"
                },
                {
                  "lessThan": "c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1",
                  "status": "affected",
                  "version": "c6e3fd22cd538365bfeb82997d5b89562e077d42",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/accessibility/speakup/main.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.6.37"
                },
                {
                  "lessThan": "2.6.37",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.313",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.275",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.216",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.157",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.88",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.29",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.8.*",
                  "status": "unaffected",
                  "version": "6.8.8",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.9",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.313",
                      "versionStartIncluding": "2.6.37",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.275",
                      "versionStartIncluding": "2.6.37",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.216",
                      "versionStartIncluding": "2.6.37",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.157",
                      "versionStartIncluding": "2.6.37",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.88",
                      "versionStartIncluding": "2.6.37",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.29",
                      "versionStartIncluding": "2.6.37",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8.8",
                      "versionStartIncluding": "2.6.37",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.9",
                      "versionStartIncluding": "2.6.37",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspeakup: Avoid crash on very long word\n\nIn case a console is set up really large and contains a really long word\n(\u003e 256 characters), we have to stop before the length of the word buffer."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The overflow is reached only through the speakup console screen-reader command path (`keyboard_notifier_call` \u2192 `speakup_key` \u2192 `do_spkup` \u2192 `get_word`) combined with `VT_RESIZE`/`PIO_UNIMAP`/`KDFONTOP` ioctls on the attacker\u0027s own virtual console, all of which require a local session on the machine. There is no network or remote protocol handler involved, but console/VT access is standard local access rather than physical device attachment.\nAC:L - Every precondition is under the attacker\u0027s control: `vt_ioctl()` grants `perm=1` to the tty owner, so an unprivileged console user can `VT_RESIZE` the console past 257 columns (up to `VC_MAXCOL`=32767 outright when the VC is bound to dummycon, which has no `con_resize` clamp, or via a narrow `KDFONTOP` font under fbcon), then print a \u003e256-character word and press the say-word key. No race, no memory-layout luck, and on 4K framebuffer consoles the stock 8x16 font already yields 480 columns by default.\nPR:L - The attacker needs an ordinary unprivileged local account owning a virtual console \u2014 `current-\u003esignal-\u003etty == tty` alone satisfies the VT ioctl permission check, so no CAP_SYS_TTY_CONFIG or root is required, and `do_spkup()` performs no capability check before invoking `get_word()`.\nUI:N - The attacker performs every step themselves \u2014 resizing their own VT, loading the unimap, painting the long word, and issuing the speakup say-word/spell-word command; no separate victim needs to be induced into any action.\nS:U - The out-of-bounds write corrupts kernel `.bss` belonging to the same kernel security authority that contains the vulnerable code; no VM, hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The linear overflow lands on `spk_characters[256]`, a pointer array immediately following `buf` in `.bss`, whose entries are dereferenced and printed via `synth_printf(\"%s\", cp)` into the synth buffer that userspace reads from `/dev/softsynth` \u2014 giving an arbitrary kernel-memory read primitive disclosed to the attacker, well beyond a bounded leak.\nI:H - This is an out-of-bounds write of fully attacker-chosen 16-bit values (sourced from an attacker-loaded `inverse_trans_unicode` table) with attacker-chosen length, overwriting adjacent `.bss` pointer arrays such as `spk_our_keys[]` and `speakup_console[]`, the latter being dereferenced for writes (`speakup_console[vc_num]-\u003eht.highbuf[bi][hi] = ic[i]`) \u2014 an arbitrary-write and control-flow-influence primitive.\nA:H - Even without careful exploitation, smashing kilobytes of `.bss` past `buf[256]` corrupts live pointer arrays that speakup dereferences on the next key event, producing an immediate kernel oops/panic \u2014 the crash the commit title explicitly refers to."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:28:53.774Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/756c5cb7c09e537b87b5d3acafcb101b2ccf394f"
            },
            {
              "url": "https://git.kernel.org/stable/c/8f6b62125befe1675446923e4171eac2c012959c"
            },
            {
              "url": "https://git.kernel.org/stable/c/6401038acfa24cba9c28cce410b7505efadd0222"
            },
            {
              "url": "https://git.kernel.org/stable/c/0d130158db29f5e0b3893154908cf618896450a8"
            },
            {
              "url": "https://git.kernel.org/stable/c/89af25bd4b4bf6a71295f07e07a8ae7dc03c6595"
            },
            {
              "url": "https://git.kernel.org/stable/c/8defb1d22ba0395b81feb963b96e252b097ba76f"
            },
            {
              "url": "https://git.kernel.org/stable/c/0efb15c14c493263cb3a5f65f5ddfd4603d19a76"
            },
            {
              "url": "https://git.kernel.org/stable/c/c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1"
            }
          ],
          "title": "speakup: Avoid crash on very long word",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-26994",
        "datePublished": "2024-05-01T05:28:07.350Z",
        "dateReserved": "2024-02-19T14:20:24.206Z",
        "dateUpdated": "2026-08-05T11:28:53.774Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.