CVE-2026-68184: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68184 Overview

CVE-2026-68184 is a stack out-of-bounds read vulnerability in the Linux kernel's CD-ROM driver. The flaw exists in mmc_ioctl_cdrom_volume() within the CDROM subsystem and affects the handling of the CDROMVOLCTRL ioctl. When a CD-ROM device returns a non-zero block descriptor length, the function advances the buffer pointer for a MODE SELECT parameter list but fails to reduce cgc->buflen correspondingly. The low-level packet path then reads 8 bytes past the end of a 32-byte stack buffer and sends the overread as extra MODE SELECT payload to the device.

Critical Impact
The bug causes a stack over-read that leaks up to 8 bytes of adjacent kernel stack memory to the attached CD-ROM device, and can be triggered locally through the CDROMVOLCTRL ioctl [CWE-125].

Affected Products

Linux kernel builds containing the vulnerable mmc_ioctl_cdrom_volume() implementation in drivers/cdrom/cdrom.c
Systems exposing the /dev/cdrom (or equivalent) block device to user space with CDROMVOLCTRL ioctl access
Drives that return a non-zero block descriptor length in the audio control mode page response

Discovery Timeline

2026-08-10 - CVE-2026-68184 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68184

Vulnerability Analysis

The defect is located in mmc_ioctl_cdrom_volume() in the Linux kernel CD-ROM driver. The function first reads the audio control mode page into a 32-byte stack buffer with cgc->buflen set to 24. If the device reports a block descriptor, the function increases cgc->buflen to include that descriptor and re-issues the read.

For the CDROMVOLCTRL ioctl, the code then constructs a MODE SELECT parameter list by advancing cgc->buffer forward by offset - 8 bytes. This drops the block descriptor from the outgoing payload and prepends a new 8-byte mode parameter header. The critical error is that cgc->buflen is not decreased by the same amount.

With a standard 8-byte block descriptor, cgc->buffer points at buffer + 8 while cgc->buflen still equals 32. cdrom_mode_select() therefore instructs the packet layer to transfer 32 bytes starting from the shifted pointer, reading 8 bytes beyond the end of the 32-byte stack allocation.

Root Cause

The root cause is desynchronization between a buffer pointer and its associated length counter. The buffer pointer is advanced to skip the block descriptor, but the length field retains its pre-shift value. This is a classic length-tracking error following pointer arithmetic on a bounded stack buffer.

Attack Vector

A local user with permission to issue ioctls to a CD-ROM device can trigger the over-read by calling CDROMVOLCTRL against a drive that returns a non-zero block descriptor length. The 8 bytes of adjacent stack data are transmitted to the device as part of the MODE SELECT payload rather than surfacing as an obvious local failure. CDROMVOLREAD does not exercise the vulnerable path. Because the trigger depends on device-reported behavior, the bug went unnoticed on drives that report a zero-length block descriptor. The corresponding patches are tracked in the Kernel Git Commit Patch and related stable-tree commits.

Detection Methods for CVE-2026-68184

Indicators of Compromise

Unexpected CDROMVOLCTRL ioctl invocations against /dev/sr* or /dev/cdrom from unprivileged or non-media user contexts
KASAN or KMSAN reports flagging out-of-bounds reads inside mmc_ioctl_cdrom_volume() or cdrom_mode_select()
Anomalous MODE SELECT SCSI packets carrying trailing bytes beyond the expected mode parameter list length

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface the stack over-read at runtime
Audit ioctl syscall telemetry for CDROMVOLCTRL (0x530A) calls originating from non-media-management processes
Correlate SCSI trace logs with kernel version data to identify unpatched hosts issuing malformed MODE SELECT commands

Monitoring Recommendations

Track the running kernel version across managed Linux fleets and flag hosts on pre-patch stable branches
Alert on processes opening CD-ROM device nodes when no optical media workflow is expected on that host
Monitor dmesg for CD-ROM subsystem warnings that reference cdrom_mode_select or unusual mode page transfers

How to Mitigate CVE-2026-68184

Immediate Actions Required

Apply the upstream stable-tree patches that reduce cgc->buflen by the same amount as the buffer pointer adjustment before calling cdrom_mode_select()
Rebuild and redeploy affected kernels, or install distribution updates that pull in the fix
Restrict access to CD-ROM device nodes to trusted users and service accounts on multi-tenant hosts

Patch Information

The fix reduces cgc->buflen in mmc_ioctl_cdrom_volume() so the MODE SELECT transfer covers only the intended parameter list. Patch commits are available in the mainline and stable trees, including Kernel Git Commit Details, Kernel Git Commit Patch, Kernel Git Commit Update, Kernel Git Commit Change, and Kernel Git Commit Modification.

Workarounds

Unload the cdrom and sr_mod modules on hosts that do not require optical media support
Tighten permissions on /dev/sr* and /dev/cdrom so only privileged operators can issue ioctls
Disable or blacklist CD-ROM device nodes in container and VM images that have no legitimate optical media use case

bash

# Configuration example: prevent loading of the vulnerable CD-ROM modules
echo 'install cdrom /bin/false' | sudo tee /etc/modprobe.d/disable-cdrom.conf
echo 'install sr_mod /bin/false' | sudo tee -a /etc/modprobe.d/disable-cdrom.conf
sudo rmmod sr_mod cdrom 2>/dev/null || true