The kernel's mmc_ioctl_cdrom_volume handler incorrectly reads a 32‑byte audio control page into a 24‑byte stack buffer and later adjusts the buffer pointer by eight bytes for a MODE SELECT operation. Because the buffer size is not updated, the lower‑level packet path is directed to write 32 bytes from a pointer that is eight bytes past the end of the allocated stack space. This out‑of‑bounds read leaks eight bytes of kernel stack data, potentially exposing sensitive information such as kernel pointers or credentials. The vulnerability only surfaces when a CD‑ROM drive reports a non‑zero block descriptor and when the CDROMVOLCTRL command is issued, and it does not cause visible failures or immediate code execution.

The flaw exists in any Linux kernel version that incorporates the CDROM subsystem prior to the commits referenced in the advisory, regardless of distribution vendor. No specific kernel release is mentioned, indicating that all systems running a pre‑patch kernel are potentially vulnerable.

This is a local information‑disclosure issue; an attacker must have physical or trusted access to a CD/DVD device and the ability to send CDROMVOLCTRL commands, which typically requires root or device‑specific privileges. The CVSS score of 4.7 indicates moderate severity, and the EPSS score is less than 1%, so the risk of exploitation is low. The flaw is not listed in CISA's KEV catalogue. The lack of a remote exploitation vector and the small amount of leaked data suggest a low to moderate risk profile. Until the kernel is updated, the exposure remains limited to the kernel stack area read by the device driver.