High 7.8Published Jun 19, 2024

CVE-2024-38587speakup: Fix sizeof() vs ARRAY_SIZE() bug

Updated under an hour ago (Oct 26, 2026, 3:10 PM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: speakup: Fix sizeof() vs ARRAY_SIZE() bug The "buf" pointer is an array of u16 values. This code should be using ARRAY_SIZE() (which is 256) instead of sizeof() (which is 512), otherwise it can the still got out of bounds.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	756c5cb7c09e537b87b5d3acafcb101b2ccf394f builds before 42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358; from 8f6b62125befe1675446923e4171eac2c012959c before cd7f3978c2ec741aedd1d860b2adb227314cf996; 6401038acfa24cba9c28cce410b7505efadd0222 builds before 07ef95cc7a579731198c93beed281e3a79a0e586; from 0d130158db29f5e0b3893154908cf618896450a8 before 504178fb7d9f6cdb0496d5491efb05f45597e535; from 89af25bd4b4bf6a71295f07e07a8ae7dc03c6595 before 3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e; from 8defb1d22ba0395b81feb963b96e252b097ba76f before c6e1650cf5df1bd6638eeee231a683ef30c7d4eb; from 0efb15c14c493263cb3a5f65f5ddfd4603d19a76 before eb1ea64328d4cc7d7a912c563f8523d5259716ef; from c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1 before d52c04474feac8e305814a5228e622afe481b2ef; and 8 more ranges	CNA record
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name)	before V3.1	CISA ADP
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family siemens:scalance_xc_300_xr_300_xc_400_xr_500wg_xr_500_family (from the name)	all versions not affected	CISA ADP
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family siemens:scalance_xcm_xrm_xch_xrh_300_family (from the name)	before V3.1	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	before V1.1.1	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.19.313 before 4.19.316; from 5.4.275 before 5.4.278; from 5.10.216 before 5.10.219; from 5.15.157 before 5.15.161; from 6.1.88 before 6.1.93; from 6.6.29 before 6.6.33; from 6.8.8 before 6.8.12; from 6.9 before 6.9.3	NVD

References

References

https://git.kernel.org/stable/c/42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358	patch
https://git.kernel.org/stable/c/cd7f3978c2ec741aedd1d860b2adb227314cf996	patch
https://git.kernel.org/stable/c/07ef95cc7a579731198c93beed281e3a79a0e586	patch
https://git.kernel.org/stable/c/504178fb7d9f6cdb0496d5491efb05f45597e535	patch
https://git.kernel.org/stable/c/3726f75a1ccc16cd335c0ccfad1d92ee08ecba5e	patch
https://git.kernel.org/stable/c/c6e1650cf5df1bd6638eeee231a683ef30c7d4eb	patch
https://git.kernel.org/stable/c/eb1ea64328d4cc7d7a912c563f8523d5259716ef	patch
https://git.kernel.org/stable/c/d52c04474feac8e305814a5228e622afe481b2ef	patch
https://git.kernel.org/stable/c/008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b	patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.