{"id":"CVE-2026-72415","title":"ASoC: SDCA: Validate written enum value in ge_put_enum_double()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SDCA: Validate written enum value in ge_put_enum_double()\n\nge_put_enum_double() passes the user-supplied enumeration index\nitem[0] to snd_soc_enum_item_to_val() w…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 812ff1baa764080ba37bb0729e0c23c0e869b542 < 33387bf9bb6116a0429f823f8dab3accf8f8e09c","Linux >= 812ff1baa764080ba37bb0729e0c23c0e869b542 < 1ce42a11bed134903e352010a01fa53073a6b395","Linux 7.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T18:49:15.372697Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T18:55:22.361Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72415","references":[{"url":"https://git.kernel.org/stable/c/33387bf9bb6116a0429f823f8dab3accf8f8e09c"},{"url":"https://git.kernel.org/stable/c/1ce42a11bed134903e352010a01fa53073a6b395"}],"tags":["cve.org"],"epss":0.00156,"epssPercentile":0.04333,"ingestedAt":"2026-10-16T19:46:24.398Z","slug":"CVE-2026-72415","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SDCA: Validate written enum value in ge_put_enum_double()\n\nge_put_enum_double() passes the user-supplied enumeration index\nitem[0] to snd_soc_enum_item_to_val() without checking it against the\nnumber of items in the enum:\n\n\tret = snd_soc_enum_item_to_val(e, item[0]);\n\nsnd_soc_enum_item_to_val() indexes the heap-allocated e->values[] array\nwith that index (e->values is set from a devm_kcalloc() of e->items\nentries), so a control write with an out-of-range item[0] reads past the\nend of the values buffer.  The bounds check in\nsnd_soc_dapm_put_enum_double() only runs afterwards, so it does not\nprevent the read here.\n\nReject an out-of-range item before using it, matching the other enum put\nhandlers.\n\nThis issue was pointed out by the Sashiko AI review bot while reviewing a\nrelated enum-validation series:\nhttps://lore.kernel.org/all/20260609125735.CEB651F00893@smtp.kernel.org/\n\n## Affected\n\n- `Linux >= 812ff1baa764080ba37bb0729e0c23c0e869b542 < 33387bf9bb6116a0429f823f8dab3accf8f8e09c`\n- `Linux >= 812ff1baa764080ba37bb0729e0c23c0e869b542 < 1ce42a11bed134903e352010a01fa53073a6b395`\n- `Linux 7.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}