CVE-2026-68184

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

cdrom: fix stack out-of-bounds read in CDROMVOLCTRL

mmc_ioctl_cdrom_volume() first reads the audio control mode page into a

32-byte stack buffer with cgc->buflen set to 24. If the device reports a

block descriptor, the function increases cgc->buflen to include that

descriptor and reads the page again.

For CDROMVOLCTRL, the function then builds a MODE SELECT parameter list

by moving cgc->buffer forward by offset - 8 bytes. This drops the block

descriptor from the outgoing payload and leaves a new 8-byte mode

parameter header in front of the audio control page. However, cgc->buflen

is left unchanged.

With a standard 8-byte block descriptor, cgc->buffer points at buffer + 8

but cgc->buflen remains 32. cdrom_mode_select() therefore asks the low

level packet path to write 32 bytes from that adjusted pointer, reading 8

bytes past the end of the 32-byte stack buffer.

This is not hit by CDROMVOLREAD, and CDROMVOLCTRL

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References