---
id: CVE-2026-72415
title: 'ASoC: SDCA: Validate written enum value in ge_put_enum_double()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ASoC: SDCA: Validate written enum value in ge_put_enum_double()

  ge_put_enum_double() passes the user-supplied enumeration index
  item[0] to snd_soc_enum_item_to_val() w…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 812ff1baa764080ba37bb0729e0c23c0e869b542 <
    33387bf9bb6116a0429f823f8dab3accf8f8e09c
  - >-
    Linux >= 812ff1baa764080ba37bb0729e0c23c0e869b542 <
    1ce42a11bed134903e352010a01fa53073a6b395
  - Linux 7.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T18:49:15.372697Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:22.361Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72415'
references:
  - url: 'https://git.kernel.org/stable/c/33387bf9bb6116a0429f823f8dab3accf8f8e09c'
  - url: 'https://git.kernel.org/stable/c/1ce42a11bed134903e352010a01fa53073a6b395'
tags:
  - cve.org
epss: 0.00156
epssPercentile: 0.04333
ingestedAt: '2026-10-16T19:46:24.398Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SDCA: Validate written enum value in ge_put_enum_double()

ge_put_enum_double() passes the user-supplied enumeration index
item[0] to snd_soc_enum_item_to_val() without checking it against the
number of items in the enum:

	ret = snd_soc_enum_item_to_val(e, item[0]);

snd_soc_enum_item_to_val() indexes the heap-allocated e->values[] array
with that index (e->values is set from a devm_kcalloc() of e->items
entries), so a control write with an out-of-range item[0] reads past the
end of the values buffer.  The bounds check in
snd_soc_dapm_put_enum_double() only runs afterwards, so it does not
prevent the read here.

Reject an out-of-range item before using it, matching the other enum put
handlers.

This issue was pointed out by the Sashiko AI review bot while reviewing a
related enum-validation series:
https://lore.kernel.org/all/20260609125735.CEB651F00893@smtp.kernel.org/

## Affected

- `Linux >= 812ff1baa764080ba37bb0729e0c23c0e869b542 < 33387bf9bb6116a0429f823f8dab3accf8f8e09c`
- `Linux >= 812ff1baa764080ba37bb0729e0c23c0e869b542 < 1ce42a11bed134903e352010a01fa53073a6b395`
- `Linux 7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.