CVE-2026-68184 (GCVE-0-2026-68184)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:59 – Updated: 2026-08-19 16:30
VLAI
Title
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
Summary
In the Linux kernel, the following vulnerability has been resolved: cdrom: fix stack out-of-bounds read in CDROMVOLCTRL mmc_ioctl_cdrom_volume() first reads the audio control mode page into a 32-byte stack buffer with cgc->buflen set to 24. If the device reports a block descriptor, the function increases cgc->buflen to include that descriptor and reads the page again. For CDROMVOLCTRL, the function then builds a MODE SELECT parameter list by moving cgc->buffer forward by offset - 8 bytes. This drops the block descriptor from the outgoing payload and leaves a new 8-byte mode parameter header in front of the audio control page. However, cgc->buflen is left unchanged. With a standard 8-byte block descriptor, cgc->buffer points at buffer + 8 but cgc->buflen remains 32. cdrom_mode_select() therefore asks the low level packet path to write 32 bytes from that adjusted pointer, reading 8 bytes past the end of the 32-byte stack buffer. This is not hit by CDROMVOLREAD, and CDROMVOLCTRL only triggers it on drives that return a non-zero block descriptor length, which helps explain why it has gone unnoticed. The overread is also sent to the device as extra MODE SELECT payload, so it may not produce an obvious local failure. Reduce cgc->buflen by the same amount as the buffer pointer adjustment so the MODE SELECT transfer covers only the intended parameter list.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 45c65df5339deea3cf204902aac383fe995941a7 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0329b661349f42f9616f2733da67edffbbb8455d (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e150c9a10baee55d3bfbc96dbe66b205e8b4fd44 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7344c84e32413e5c8832f74b8a612b0194e5c051 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 35b68e24c5a69fa4545f46f05f6c849223034cb6 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < d43c5c0c935522deae7339e0c2399365f3bf0016 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < f3e2715a150066f09aa82c30fa983fb184ad6dd5 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b27e195d4db8dea263050bdbeb11881b2999c9c6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.12
Unaffected: 0 , < 2.6.12 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/cdrom/cdrom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "45c65df5339deea3cf204902aac383fe995941a7",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "0329b661349f42f9616f2733da67edffbbb8455d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e150c9a10baee55d3bfbc96dbe66b205e8b4fd44",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "7344c84e32413e5c8832f74b8a612b0194e5c051",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "35b68e24c5a69fa4545f46f05f6c849223034cb6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d43c5c0c935522deae7339e0c2399365f3bf0016",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f3e2715a150066f09aa82c30fa983fb184ad6dd5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b27e195d4db8dea263050bdbeb11881b2999c9c6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/cdrom/cdrom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncdrom: fix stack out-of-bounds read in CDROMVOLCTRL\n\nmmc_ioctl_cdrom_volume() first reads the audio control mode page into a\n32-byte stack buffer with cgc-\u003ebuflen set to 24.  If the device reports a\nblock descriptor, the function increases cgc-\u003ebuflen to include that\ndescriptor and reads the page again.\n\nFor CDROMVOLCTRL, the function then builds a MODE SELECT parameter list\nby moving cgc-\u003ebuffer forward by offset - 8 bytes.  This drops the block\ndescriptor from the outgoing payload and leaves a new 8-byte mode\nparameter header in front of the audio control page.  However, cgc-\u003ebuflen\nis left unchanged.\n\nWith a standard 8-byte block descriptor, cgc-\u003ebuffer points at buffer + 8\nbut cgc-\u003ebuflen remains 32.  cdrom_mode_select() therefore asks the low\nlevel packet path to write 32 bytes from that adjusted pointer, reading 8\nbytes past the end of the 32-byte stack buffer.\n\nThis is not hit by CDROMVOLREAD, and CDROMVOLCTRL only triggers it on\ndrives that return a non-zero block descriptor length, which helps explain\nwhy it has gone unnoticed.  The overread is also sent to the device as\nextra MODE SELECT payload, so it may not produce an obvious local failure.\n\nReduce cgc-\u003ebuflen by the same amount as the buffer pointer adjustment so\nthe MODE SELECT transfer covers only the intended parameter list."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:30:51.908Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/45c65df5339deea3cf204902aac383fe995941a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/0329b661349f42f9616f2733da67edffbbb8455d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e150c9a10baee55d3bfbc96dbe66b205e8b4fd44"
        },
        {
          "url": "https://git.kernel.org/stable/c/7344c84e32413e5c8832f74b8a612b0194e5c051"
        },
        {
          "url": "https://git.kernel.org/stable/c/35b68e24c5a69fa4545f46f05f6c849223034cb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/d43c5c0c935522deae7339e0c2399365f3bf0016"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3e2715a150066f09aa82c30fa983fb184ad6dd5"
        },
        {
          "url": "https://git.kernel.org/stable/c/b27e195d4db8dea263050bdbeb11881b2999c9c6"
        }
      ],
      "title": "cdrom: fix stack out-of-bounds read in CDROMVOLCTRL",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68184",
    "datePublished": "2026-08-10T11:59:56.319Z",
    "dateReserved": "2026-07-30T09:28:09.373Z",
    "dateUpdated": "2026-08-19T16:30:51.908Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68184",
      "date": "2026-08-20",
      "epss": "0.0021",
      "percentile": "0.11555"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68184\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:05.497\",\"lastModified\":\"2026-08-19T17:20:34.593\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncdrom: fix stack out-of-bounds read in CDROMVOLCTRL\\n\\nmmc_ioctl_cdrom_volume() first reads the audio control mode page into a\\n32-byte stack buffer with cgc-\u003ebuflen set to 24.  If the device reports a\\nblock descriptor, the function increases cgc-\u003ebuflen to include that\\ndescriptor and reads the page again.\\n\\nFor CDROMVOLCTRL, the function then builds a MODE SELECT parameter list\\nby moving cgc-\u003ebuffer forward by offset - 8 bytes.  This drops the block\\ndescriptor from the outgoing payload and leaves a new 8-byte mode\\nparameter header in front of the audio control page.  However, cgc-\u003ebuflen\\nis left unchanged.\\n\\nWith a standard 8-byte block descriptor, cgc-\u003ebuffer points at buffer + 8\\nbut cgc-\u003ebuflen remains 32.  cdrom_mode_select() therefore asks the low\\nlevel packet path to write 32 bytes from that adjusted pointer, reading 8\\nbytes past the end of the 32-byte stack buffer.\\n\\nThis is not hit by CDROMVOLREAD, and CDROMVOLCTRL only triggers it on\\ndrives that return a non-zero block descriptor length, which helps explain\\nwhy it has gone unnoticed.  The overread is also sent to the device as\\nextra MODE SELECT payload, so it may not produce an obvious local failure.\\n\\nReduce cgc-\u003ebuflen by the same amount as the buffer pointer adjustment so\\nthe MODE SELECT transfer covers only the intended parameter list.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/cdrom/cdrom.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"45c65df5339deea3cf204902aac383fe995941a7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"0329b661349f42f9616f2733da67edffbbb8455d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"e150c9a10baee55d3bfbc96dbe66b205e8b4fd44\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"7344c84e32413e5c8832f74b8a612b0194e5c051\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"35b68e24c5a69fa4545f46f05f6c849223034cb6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"d43c5c0c935522deae7339e0c2399365f3bf0016\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"f3e2715a150066f09aa82c30fa983fb184ad6dd5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"b27e195d4db8dea263050bdbeb11881b2999c9c6\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/cdrom/cdrom.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.148\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0329b661349f42f9616f2733da67edffbbb8455d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/35b68e24c5a69fa4545f46f05f6c849223034cb6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/45c65df5339deea3cf204902aac383fe995941a7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7344c84e32413e5c8832f74b8a612b0194e5c051\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b27e195d4db8dea263050bdbeb11881b2999c9c6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d43c5c0c935522deae7339e0c2399365f3bf0016\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e150c9a10baee55d3bfbc96dbe66b205e8b4fd44\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f3e2715a150066f09aa82c30fa983fb184ad6dd5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-13T09:16:29+00:00",
      "cve": "CVE-2026-68184",
      "id": "CVE-2026-68184",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "275",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cdrom: fix stack out-of-bounds read in CDROMVOLCTRL",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68184.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-08-13T16:23:22Z",
      "cve": "CVE-2026-68184",
      "id": "CVE-2026-68184",
      "initial_release_date": "2026-08-13T16:23:22Z",
      "product_status:known_affected": "202",
      "product_status:known_not_affected": "94",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68184",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68184.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.