CVE-2026-68184 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
mmc_ioctl_cdrom_volume() first reads the audio control mode page into a 32-byte stack buffer with cgc->buflen set to 24. If the device reports a block descriptor, the function increases cgc->buflen to include that descriptor and reads the page again.
For CDROMVOLCTRL, the function then builds a MODE SELECT parameter list by moving cgc->buffer forward by offset - 8 bytes. This drops the block descriptor from the outgoing payload and leaves a new 8-byte mode parameter header in front of the audio control page. However, cgc->buflen is left unchanged.
With a standard 8-byte block descriptor, cgc->buffer points at buffer + 8 but cgc->buflen remains 32. cdrom_mode_select() therefore asks the low level packet path to write 32 bytes from that adjusted pointer, reading 8 bytes past the end of the 32-byte stack buffer.
This is not hit by CDROMVOLREAD, and CDROMVOLCTRL only triggers it on drives that return a non-zero block descriptor length, which helps explain why it has gone unnoticed. The overread is also sent to the device as extra MODE SELECT payload, so it may not produce an obvious local failure.
Reduce cgc->buflen by the same amount as the buffer pointer adjustment so the MODE SELECT transfer covers only the intended parameter list.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability in question involves a stack out-of-bounds read within the Linux kernel's CD-ROM subsystem, specifically affecting the mmc_ioctl_cdrom_volume() function. This flaw occurs during handling of CDROMVOLCTRL operations where the kernel attempts to read audio control mode pages from CD-ROM devices. The issue stems from improper buffer management when dealing with block descriptors returned by certain optical drives, creating a scenario where memory accesses extend beyond allocated stack space.
The technical implementation of this vulnerability begins with the function reading an audio control mode page into a 32-byte stack buffer while setting cgc->buflen to 24 bytes. When devices report block descriptors, the function dynamically increases cgc->buflen to accommodate these descriptors and performs a second read operation. The problematic behavior manifests during parameter list construction for MODE SELECT commands where the function adjusts cgc->buffer pointer forward by offset minus 8 bytes, effectively removing the block descriptor from outgoing payload while inserting an 8-byte mode parameter header. However, this pointer adjustment does not correspondingly reduce cgc->buflen, creating a mismatch between buffer size and actual data to be transferred.
This vulnerability falls under CWE-121, heap-based buffer overflow, and more specifically relates to improper handling of buffer boundaries in kernel space operations. The flaw operates at the intersection of multiple attack vectors including privilege escalation through kernel exploitation and potential information disclosure via memory corruption. The operational impact is significant as it represents a potential pathway for malicious actors to execute arbitrary code within kernel space, compromising system integrity and potentially escalating privileges.
The vulnerability's detection complexity arises from its conditional nature where the overread only occurs on drives returning non-zero block descriptor lengths. This characteristic explains why the flaw remained undetected for extended periods in production environments. The actual overread extends 8 bytes beyond the intended 32-byte stack buffer, with the excess data being transmitted to devices as additional MODE SELECT payload. This behavior may not produce immediate or obvious failures, making the vulnerability particularly insidious and difficult to identify through standard testing procedures.
Mitigation strategies must focus on proper buffer boundary management within kernel code, specifically ensuring that buffer size parameters accurately reflect pointer adjustments during data processing operations. The fix requires reducing cgc->buflen by the same amount as the buffer pointer adjustment to maintain consistency between allocated memory space and actual data transfer requirements. This approach aligns with established security practices for kernel development and follows recommendations from the ATT&CK framework's privilege escalation techniques, particularly those involving kernel memory corruption vulnerabilities. System administrators should ensure all kernel updates are applied promptly to address this vulnerability, as it represents a critical security risk in environments where CD-ROM functionality is utilized.