Description
An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers on systems with the speakup driver could cause a local denial of service attack, aka CID-d41227544427. This occurs because of an invalid free when the line discipline is used more than once.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 5.9.11-1 | — |
| Debian 13 | linux | 5.9.11-1 | — |
| Debian 12 | linux | 5.9.11-1 | — |
| Debian 9 | linux-4.19 | 4.19.160-2~deb9u1 | DLA-2483-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux-raspi-realtime | No fix yet | — |
| Ubuntu 22.04 LTS | linux-realtime +1 | No fix yet | — |
| Ubuntu 20.04 LTS | linux | 5.4.0-66.74 | USN-4750-1 |
| Ubuntu 20.04 LTS | linux-aws | 5.4.0-1038.40 | USN-4750-1 |
| Ubuntu 20.04 LTS | linux-azure | 5.4.0-1040.42 | USN-4750-1 |
| Ubuntu 20.04 LTS | linux-gcp | 5.4.0-1037.40 | USN-4750-1 |
| Ubuntu 20.04 LTS | linux-gke | 5.4.0-1036.38 | — |
| Ubuntu 20.04 LTS | linux-gkeop | 5.4.0-1010.11 | USN-4750-1 |
| Ubuntu 20.04 LTS | linux-hwe-5.8 | 5.8.0-44.50~20.04.1 | USN-4751-1 |
| Ubuntu 20.04 LTS | linux-kvm | 5.4.0-1033.34 | USN-4750-1 |
| Ubuntu 20.04 LTS | linux-oracle | 5.4.0-1038.41 | USN-4750-1 |
| Ubuntu 20.04 LTS | linux-raspi | 5.4.0-1029.32 | USN-4750-1 |
| Ubuntu 20.04 LTS | linux-riscv +2 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-riscv-5.8 | 5.8.0-17.19~20.04.1 | — |
| Ubuntu 18.04 LTS | linux | 4.15.0-136.140 | USN-4749-1 |
| Ubuntu 18.04 LTS | linux-aws | 4.15.0-1094.101 | USN-4749-1 |
| Ubuntu 18.04 LTS | linux-aws-5.4 | 5.4.0-1038.40~18.04.1 | USN-4750-1 |
| Ubuntu 18.04 LTS | linux-azure-4.15 | 4.15.0-1108.120 | USN-4749-1 |
| Ubuntu 18.04 LTS | linux-azure-5.4 | 5.4.0-1040.42~18.04.1 | USN-4750-1 |
| Ubuntu 18.04 LTS | linux-dell300x | 4.15.0-1012.16 | USN-4749-1 |
| Ubuntu 18.04 LTS | linux-gcp +12 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp-4.15 | 4.15.0-1093.106 | USN-4749-1 |
| Ubuntu 18.04 LTS | linux-gcp-5.4 | 5.4.0-1037.40~18.04.1 | USN-4750-1 |
| Ubuntu 18.04 LTS | linux-gke-5.4 | 5.4.0-1036.38~18.04.1 | USN-4750-1 |
| Ubuntu 18.04 LTS | linux-gkeop-5.4 | 5.4.0-1010.11~18.04.1 | USN-4750-1 |
| Ubuntu 18.04 LTS | linux-hwe-5.4 | 5.4.0-66.74~18.04.2 | USN-4750-1 |
| Ubuntu 18.04 LTS | linux-kvm | 4.15.0-1085.87 | USN-4749-1 |
| Ubuntu 18.04 LTS | linux-oracle | 4.15.0-1065.73 | USN-4749-1 |
| Ubuntu 18.04 LTS | linux-oracle-5.4 | 5.4.0-1038.41~18.04.1 | USN-4750-1 |
| Ubuntu 18.04 LTS | linux-raspi-5.4 | 5.4.0-1029.32~18.04.1 | USN-4750-1 |
| Ubuntu 18.04 LTS | linux-raspi2 +1 | 4.15.0-1079.84 | USN-4749-1 |
| Ubuntu 18.04 LTS | linux-snapdragon | 4.15.0-1096.105 | USN-4749-1 |
| Ubuntu 16.04 LTS | linux-aws-hwe | 4.15.0-1094.101~16.04.1 | USN-4749-1 |
| Ubuntu 16.04 LTS | linux-azure | 4.15.0-1108.120~16.04.1 | USN-4749-1 |
| Ubuntu 16.04 LTS | linux-gcp | 4.15.0-1093.106~16.04.1 | USN-4749-1 |
| Ubuntu 16.04 LTS | linux-hwe | 4.15.0-136.140~16.04.1 | USN-4749-1 |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu 16.04 LTS | linux-oracle | 4.15.0-1065.73~16.04.1 | USN-4749-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro FIPS 20.04 LTS | linux-aws-fips +2 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-aws-fips | 5.4.0-1069.73+fips2 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-azure-fips | 5.4.0-1073.76+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-gcp-fips | 5.4.0-1067.71~20.04.1 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-aws-fips | 4.15.0-2037.39 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-azure-fips | 4.15.0-2020.23 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips | 4.15.0-1053.61 | — |
| Ubuntu Pro 14.04 LTS | linux-azure | 4.15.0-1108.120~14.04.1 | USN-4749-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | kernel-azure +2 | 5.3.18-18.29.1 | SUSE-SU-2020:3713-1 |
| SLES 15 SP2 | kernel-default-base | 5.3.18-24.43.2.9.17.3 | SUSE-SU-2020:3748-1 |
| SLES 15 SP2 | kernel-docs +5 | 5.3.18-24.43.2 | SUSE-SU-2020:3748-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Live Patching 15 SP2 | kernel-default | 5.3.18-24.43.2 | SUSE-SU-2020:3748-1 |
| SLE Live Patching 15 SP2 | kernel-livepatch-SLE15-SP2_Update_8 | 1-5.3.3 | SUSE-SU-2020:3748-1 |
| SUSE Real Time Module 15 SP2 | kernel-rt +3 | 5.3.18-19.1 | SUSE-SU-2020:3764-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.2 | kernel-default-base | 5.3.18-lp152.54.1.lp152.8.12.1 | openSUSE-SU-2020:2260-1, openSUSE-SU-2020:2161-1 |
| openSUSE Leap 15.2 | kernel-docs | 5.3.18-lp152.54.2 | openSUSE-SU-2020:2161-1 |
| openSUSE Leap 15.2 | kernel-rt +3 | 5.3.18-lp152.3.5.1 | openSUSE-SU-2021:0242-1 |
| openSUSE Leap 15.2 | kernel-syms +7 | 5.3.18-lp152.54.1 | openSUSE-SU-2020:2161-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | kernel-livepatch-4.14.209-160.335 | 1.0-0.amzn2 | ALAS2-2020-1566 |
| Amazon Linux 2 | perf +8 | 4.14.209-160.335.amzn2 | ALAS2-2020-1566 |
Advisories 11
- USN-4750-1 linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities Ubuntu Security Notices (USN) · Jun 3, 2026
- USN-4749-1 linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities Ubuntu Security Notices (USN) · Jun 3, 2026
- USN-4751-1 linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.8, linux-kvm, linux-oracle, linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Jun 3, 2026
- DLA-2483-1 linux-4.19 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2020:2260-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:3764-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0242-1 Security update for RT kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:2161-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:3713-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:3748-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2020-1566 Important: kernel security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Dec 8, 2020
References
- https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git/commit/?h=tty-linus&id=d4122754442799187d5d537a9c039a49a67e57f1
- https://www.openwall.com/lists/oss-security/2020/11/19/3
- https://github.com/torvalds/linux/commit/d4122754442799187d5d537a9c039a49a67e57f1
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d4122754442799187d5d537a9c039a49a67e57f1
- [oss-security] 20201119 Re: Linux kernel NULL-ptr deref bug in spk_ttyio_ldisc_close mailing-list
- FEDORA-2020-4700a73bd5 vendor-advisory
- FEDORA-2020-8c15928d23 vendor-advisory
- [debian-lts-announce] 20201210 [SECURITY] [DLA 2483-1] linux-4.19 security update mailing-list