VulnerabilityPublished 10 Aug 2026Updated 6 Nov 2026

CVE-2026-68184: Linux kernel · cdrom: fix stack out-of-bounds read in CDROMVOLCTRL

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in f3e2715a150066f09aa82c30fa983fb184ad6dd5 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 17:19 UTC

Severity

Low

Rated Low by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in f3e2715a150066f09aa82c30fa983fb184ad6dd5, e150c9a10baee55d3bfbc96dbe66b205e8b4fd44, d43c5c0c935522deae7339e0c2399365f3bf0016 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 10 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < f3e2715a150066f09aa82c30fa983fb184ad6dd5	Fixed in f3e2715a150066f09aa82c30fa983fb184ad6dd5
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < e150c9a10baee55d3bfbc96dbe66b205e8b4fd44	Fixed in e150c9a10baee55d3bfbc96dbe66b205e8b4fd44
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < d43c5c0c935522deae7339e0c2399365f3bf0016	Fixed in d43c5c0c935522deae7339e0c2399365f3bf0016
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < b27e195d4db8dea263050bdbeb11881b2999c9c6	Fixed in b27e195d4db8dea263050bdbeb11881b2999c9c6
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 7344c84e32413e5c8832f74b8a612b0194e5c051	Fixed in 7344c84e32413e5c8832f74b8a612b0194e5c051
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 0329b661349f42f9616f2733da67edffbbb8455d	Fixed in 0329b661349f42f9616f2733da67edffbbb8455d

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A fix is available and has been applied in the Linux kernel source. Users should update to a kernel version that includes the fix identified by the provided commit hashes. No additional mitigation is required as the patch corrects the buffer length handling to prevent the out-of-bounds read.

Description

A stack out-of-bounds read vulnerability was fixed in the Linux kernel's CDROMVOLCTRL ioctl handling. The flaw involves an incorrect buffer length calculation when building a MODE SELECT parameter list, causing an 8-byte overread from a stack buffer. This occurs only on drives reporting a non-zero block descriptor length and may not cause obvious local failures. The issue was resolved by adjusting the buffer length to match the pointer offset, preventing the out-of-bounds read.

Impact

The vulnerability results in a stack out-of-bounds read of 8 bytes, which could lead to unintended data being sent to the device as extra MODE SELECT payload. There is no indication of local crashes or obvious failures, and no known exploits in the wild. The impact is limited to information disclosure or potential device misbehavior due to the malformed payload.

Summary

CVE-2026-68184 addresses a stack out-of-bounds read in the Linux kernel's cdrom ioctl handler CDROMVOLCTRL. The function mmc_ioctl_cdrom_volume() reads an audio control mode page into a 32-byte stack buffer with an initial length of 24 bytes. If the device reports a block descriptor, the buffer length is increased, and the page is reread. When constructing the MODE SELECT parameter list, the buffer pointer is advanced by 8 bytes to drop the block descriptor, but the buffer length remains unchanged at 32 bytes. This causes cdrom_mode_select() to write 32 bytes from the adjusted pointer, reading 8 bytes beyond the stack buffer's end. The vulnerability only triggers on drives with a non-zero block descriptor length and is not triggered by CDROMVOLREAD. The fix reduces the buffer length by the same offset as the pointer adjustment to ensure the MODE SELECT transfer covers only the intended data.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 17:18 UTC

Technical details

References

Community reviews

Related threats