Kernel compromise via Speakup buffer overrun

Out-of-bounds access in the Linux Speakup console driver allows local users to compromise the kernel through a crafted virtual console. The get_word function compares a 256-element u16 buffer index against sizeof(buf), permitting up to 511 elements and overwriting adjacent kernel data. Exploitation requires an unprivileged virtual-console session, a widened console, Speakup input, and a say-word keypress; consequences include kernel data disclosure, control-flow hijacking, or a panic.