The dvd_read_bca function in the DVD handling code in drivers/cdrom/cdrom.c in Linux kernel 2.2.16 and later versions assigns the wrong value to a length variable which allows local users to execute arbitrary code via a crafted USB Storage device that triggers a buffer overflow.