{"id":"AZL-103004","summary":"CVE-2026-93053 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nspeakup: keyhelp: guard letter_offsets possible out-of-range indexing\n\nhelp_init() builds letter_offsets[] by using the first byte of each\nfunction name as an index via `(start & 31) - 1`. If function_names are\noverridden from sysfs (root) with a name starting outside [a–z], the\nindex underflows or exceeds the array, leading to OOB write.\n\nFunction names can be overridden with the following commands as root:\n\n    modprobe speakup_soft\n    echo \"0 _bad\" \u003e /sys/accessibility/speakup/i18n/function_names\n    # then press Insert+2 on /dev/tty\n\nThis fix checks the first letter in help_init(), and if it is not in the\n[a–z] range the function returns an error to the caller. Eventually this\nerror is propagated to drivers/accessibility/speakup/main.c:2217, which\ncauses a bleep sound.","modified":"2026-09-19T05:33:49Z","published":"2026-09-17T17:17:58Z","upstream":["CVE-2026-93053"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93053"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-103004.json"}}],"schema_version":"1.9.0"}