CVE-2026-68184

A flaw was found in the Linux kernel's CD-ROM (cdrom) driver. When handling the CDROMVOLCTRL command, the mmc_ioctl_cdrom_volume() function can perform an incorrect calculation of buffer length after a pointer adjustment. This leads to a stack out-of-bounds read, where 8 bytes of data beyond the intended memory boundary are accessed. This unintended data is then included in the MODE SELECT payload sent to the CD-ROM device, which could potentially lead to information disclosure or unexpected device behavior.

This issue affects systems with CD-ROM drives using the cdrom ioctl interface. CDROMVOLCTRL can expand buflen past the stack buffer when a block descriptor is present. Systems without optical drives are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.