CVE-2026-68184

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A stack out-of-bounds read exists in the mmc ioctl cdrom volume() function during a CDROMVOLCTRL operation. The function reads an audio control mode page into a 32-byte stack buffer. When a device reports a block descriptor, the function increases the cgc->buflen variable and reads the page again. For CDROMVOLCTRL, the function adjusts the cgc->buffer pointer forward by 8 bytes to build a MODE SELECT parameter list but fails to decrease cgc->buflen accordingly. Consequently, the cdrom mode select() function may read 8 bytes beyond the end of the stack buffer. This issue specifically affects drives that return a non-zero block descriptor length.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.