CVE-2026-68184

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> cdrom: fix stack out-of-bounds read in CDROMVOLCTRL<br /> <br /> mmc_ioctl_cdrom_volume() first reads the audio control mode page into a<br /> 32-byte stack buffer with cgc-&gt;buflen set to 24. If the device reports a<br /> block descriptor, the function increases cgc-&gt;buflen to include that<br /> descriptor and reads the page again.<br /> <br /> For CDROMVOLCTRL, the function then builds a MODE SELECT parameter list<br /> by moving cgc-&gt;buffer forward by offset - 8 bytes. This drops the block<br /> descriptor from the outgoing payload and leaves a new 8-byte mode<br /> parameter header in front of the audio control page. However, cgc-&gt;buflen<br /> is left unchanged.<br /> <br /> With a standard 8-byte block descriptor, cgc-&gt;buffer points at buffer + 8<br /> but cgc-&gt;buflen remains 32. cdrom_mode_select() therefore asks the low<br /> level packet path to write 32 bytes from that adjusted pointer, reading 8<br /> bytes past the end of the 32-byte stack buffer.<br /> <br /> This is not hit by CDROMVOLREAD, and CDROMVOLCTRL only triggers it on<br /> drives that return a non-zero block descriptor length, which helps explain<br /> why it has gone unnoticed. The overread is also sent to the device as<br /> extra MODE SELECT payload, so it may not produce an obvious local failure.<br /> <br /> Reduce cgc-&gt;buflen by the same amount as the buffer pointer adjustment so<br /> the MODE SELECT transfer covers only the intended parameter list.