CVE-2024-38587
speakup: Fix sizeof() vs ARRAY_SIZE() bug
HIGH
7.8
CVSS Score
Published: June 19, 2024 at 01:37 PM UTC
Updated: October 15, 2026 at 01:18 AM UTC
7 products affected across 2 vendorsLinux KernelSIMATIC S7-1500 TM MFPRUGGEDCOM RST2428P Firmware
Using Linux by Linux?
Get instant alerts when new vulnerabilities affect Linux - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 0.8%
SSVC
No known exploit
Description
In the Linux kernel, the following vulnerability has been resolved: speakup: Fix sizeof() vs ARRAY_SIZE() bug The "buf" pointer is an array of u16 values. This code should be using ARRAY_SIZE() (which is 256) instead of sizeof() (which is 512), otherwise it can the still got out of bounds.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
All versions4.19.313 ≤ v < 4.19.3165.10.216 ≤ v < 5.10.2195.15.157 ≤ v < 5.15.1615.4.275 ≤ v < 5.4.2786.1.88 ≤ v < 6.1.936.6.29 ≤ v < 6.6.336.8.8 ≤ v < 6.8.126.9 ≤ v < 6.9.30d130158db29f5e0b3893154908cf618896450a80efb15c14c493263cb3a5f65f5ddfd4603d19a764.19.3135.10.2165.15.1575.4.2756.1.886.6.296.8.86.96401038acfa24cba9c28cce410b7505efadd0222756c5cb7c09e537b87b5d3acafcb101b2ccf394f89af25bd4b4bf6a71295f07e07a8ae7dc03c65958defb1d22ba0395b81feb963b96e252b097ba76f8f6b62125befe1675446923e4171eac2c012959cc8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1
Vendor states this is fixed in 008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b (fixed)
Vendor states this is fixed in 07ef95cc7a579731198c93beed281e3a79a0e586 (fixed)
Vendor states this is fixed in 3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e (fixed)
Vendor states this is fixed in 42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358 (fixed)
Vendor states this is fixed in 504178fb7d9f6cdb0496d5491efb05f45597e535 (fixed)
Vendor states this is fixed in c6e1650cf5df1bd6638eeee231a683ef30c7d4eb (fixed)
Vendor states this is fixed in cd7f3978c2ec741aedd1d860b2adb227314cf996 (fixed)
Vendor states this is fixed in d52c04474feac8e305814a5228e622afe481b2ef (fixed)
Vendor states this is fixed in eb1ea64328d4cc7d7a912c563f8523d5259716ef (fixed)
Vendor states this is fixed in 4.19.316 (unaffected)
Vendor states this is fixed in 5.10.219 (unaffected)
Vendor states this is fixed in 5.15.161 (unaffected)
Vendor states this is fixed in 5.4.278 (unaffected)
Vendor states this is fixed in 6.1.93 (unaffected)
Vendor states this is fixed in 6.10 (unaffected)
Vendor states this is fixed in 6.6.33 (unaffected)
Vendor states this is fixed in 6.8.12 (unaffected)
Vendor states this is fixed in 6.9 (unaffected)
Vendor states this is fixed in 6.9.3 (unaffected)
v < V3.1
Affected range stops below V3.1, so it looks safe — our inference, not a vendor statement
v < V3.1
Affected range stops below V3.1, so it looks safe — our inference, not a vendor statement
v < V3.1
Affected range stops below V3.1, so it looks safe — our inference, not a vendor statement
v < V3.1
Affected range stops below V3.1, so it looks safe — our inference, not a vendor statement
v < V3.1
Affected range stops below V3.1, so it looks safe — our inference, not a vendor statement
All versions
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://git.kernel.org/stable/c/008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b
- https://git.kernel.org/stable/c/07ef95cc7a579731198c93beed281e3a79a0e586
- https://git.kernel.org/stable/c/3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e
- https://git.kernel.org/stable/c/42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358
- https://git.kernel.org/stable/c/504178fb7d9f6cdb0496d5491efb05f45597e535
References (12)
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/008ab3c53bc4f0b2f20013c8f6c204a3203d0b8bPatch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/07ef95cc7a579731198c93beed281e3a79a0e586Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3726f75a1ccc16cd335c0ccfad1d92ee08ecba5ePatch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/504178fb7d9f6cdb0496d5491efb05f45597e535Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c6e1650cf5df1bd6638eeee231a683ef30c7d4ebPatch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/cd7f3978c2ec741aedd1d860b2adb227314cf996Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d52c04474feac8e305814a5228e622afe481b2efSSVC — Action Prioritization
SSVCNo known exploitNot automatablePartial impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
7.8HIGHLinux
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-129
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card