CVE-2020-28941: An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9.
An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers on systems with the speakup driver could cause a local denial of service attack, aka CID-d41227544427. This occurs because of an invalid free when the line discipline is used more than once.
Security readout for executives and security teams
CVE-2020-28941 is a Linux kernel local denial-of-service issue in the Speakup accessibility driver. A local user on a system where the driver is available could crash or destabilize the system. It does not indicate remote access, data theft, or privilege escalation in the provided sources. Exposure is mainly Linux systems running affected kernels where the Speakup driver is present and usable by local users. Distribution kernels may differ because fixes can be backported, so version strings alone may be insufficient. Treat this as a routine but real availability risk for Linux fleets, especially shared systems. It is not a remote compromise signal, but kernel denial-of-service flaws can still affect service uptime and should be handled through normal kernel patch cycles. Mitigation focus: Apply vendor kernel security updates for affected Linux distributions.; Use a kernel containing upstream commit d4122754442799187d5d537a9c039a49a67e57f1.; Check Fedora, Debian, or relevant vendor advisories for corrected package versions..
Prepared
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cwe · low confidence lookup
CWE-763: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
CWE-763 · source CWE mapping
Release of Invalid Pointer or Reference
Release of Invalid Pointer or Reference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.