What is the CVSS score of CVE-2024-38587?

CVE-2024-38587 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2024-38587?

The Linux kernel speakup accessibility driver contains an out-of-bounds memory access vulnerability (CVE-2024-38587, CVSS 7.8) affecting systems with this driver enabled, allowing local users to read…. A patch is available.

How to fix or mitigate CVE-2024-38587?

Within 24 hours, identify all systems running the Linux kernel speakup accessibility driver by auditing kernel module configurations and active processes. Within 7 days, apply vendor-released patches now available across stable kernel branches (nine patch commits have been deployed upstream). Within 30 days, validate patch deployment across all affected systems, verify the speakup driver is properly configured post-patch, and document remediation completion status for compliance records.

Linux Kernel CVE-2024-38587

HIGH

Improper Validation of Array Index (CWE-129)

2024-06-19 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local-only exploitation via an authenticated low-privilege user; out-of-bounds kernel memory access yields full C/I/A impact with no scope change beyond the kernel.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 12:03 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 11:55 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

MEDIUM HIGH

CVSS changed

Aug 04, 2026 - 11:23 NVD

5.3 (MEDIUM) 7.8 (HIGH)

CVE Published

Jun 19, 2024 - 14:15 cve.org

MEDIUM 5.3

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

speakup: Fix sizeof() vs ARRAY_SIZE() bug

The "buf" pointer is an array of u16 values. This code should be using ARRAY_SIZE() (which is 256) instead of sizeof() (which is 512), otherwise it can the still got out of bounds.

AnalysisAI

Out-of-bounds kernel memory access in the Linux kernel speakup accessibility driver allows a local low-privileged user to read or corrupt kernel memory due to a sizeof() versus ARRAY_SIZE() confusion bug. The speakup driver's 'buf' variable is a u16 array of 256 elements; the flawed check used sizeof() returning 512 (bytes) instead of ARRAY_SIZE() returning 256 (elements), effectively doubling the permitted index range and enabling out-of-bounds access. Nine patch commits have been applied across multiple stable kernel branches; there is no CISA KEV listing, no public exploit code, and EPSS stands at 0.16%, indicating low real-world exploitation probability despite the 7.8 CVSS score.

Technical ContextAI

The speakup subsystem is a Linux kernel screen reader driver providing text-console accessibility for visually impaired users. The defect lies in a bounds-checking expression where 'buf' is declared as an array of u16 (16-bit unsigned integers, 2 bytes each). Using sizeof(buf) returns the buffer's byte size (256 elements × 2 bytes = 512), while ARRAY_SIZE(buf) returns the element count (256). The check therefore accepted array indices up to 511, exactly double the valid maximum of 255, allowing out-of-bounds reads or writes into adjacent kernel memory. CWE-129 (Improper Validation of Array Index) precisely describes this root cause: the index is validated against the wrong upper bound, permitting access beyond the allocated array. The CPE entries (cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*) span multiple stable branches, reflecting the patch being backported across the kernel's long-term support trees.

RemediationAI

Apply the upstream kernel patches available across multiple stable branches via the nine referenced commits at https://git.kernel.org/stable/c/008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b and siblings. Because exact minimum patched release versions per stable branch are not confirmed from the available data (commits are referenced but no tagged release version is specified), consult your Linux distribution's security tracker - Debian DSA, Ubuntu USN, Red Hat RHSA, SUSE SLES advisories - to identify the specific updated package version to deploy. As a compensating control on systems where text-console accessibility is not required, blacklist the speakup module by adding 'blacklist speakup' to /etc/modprobe.d/blacklist.conf and running 'depmod -a'; this prevents the module from loading on next boot with no side effects on non-accessibility workloads. If the module is currently loaded, unloading it with 'rmmod speakup' (if no active users) eliminates the attack surface without a reboot. Note that blacklisting disables text-console screen reader functionality for visually impaired users - evaluate the operational impact before applying on accessibility-dependent systems.