{"id":"CVE-2026-72415","state":"PUBLISHED","title":"ASoC: SDCA: Validate written enum value in ge_put_enum_double()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SDCA: Validate written enum value in ge_put_enum_double()\n\nge_put_enum_double() passes the user-supplied enumeration index\nitem[0] to snd_soc_enum_item_to_val() without checking it against the\nnumber of items in the enum:\n\n\tret = snd_soc_enum_item_to_val(e, item[0]);\n\nsnd_soc_enum_item_to_val() indexes the heap-allocated e->values[] array\nwith that index (e->values is set from a devm_kcalloc() of e->items\nentries), so a control write with an out-of-range item[0] reads past the\nend of the values buffer.  The bounds check in\nsnd_soc_dapm_put_enum_double() only runs afterwards, so it does not\nprevent the read here.\n\nReject an out-of-range item before using it, matching the other enum put\nhandlers.\n\nThis issue was pointed out by the Sashiko AI review bot while reviewing a\nrelated enum-validation series:\nhttps://lore.kernel.org/all/20260609125735.CEB651F00893@smtp.kernel.org/","publishedAt":"2026-08-15T05:56:36.210Z","updatedAt":"2026-10-16T18:55:22.361Z","severity":{"score":7.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"812ff1baa764080ba37bb0729e0c23c0e869b542","status":"affected","lessThan":"33387bf9bb6116a0429f823f8dab3accf8f8e09c","versionType":"git"},{"version":"812ff1baa764080ba37bb0729e0c23c0e869b542","status":"affected","lessThan":"1ce42a11bed134903e352010a01fa53073a6b395","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/soc/sdca/sdca_asoc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"7.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.0","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/soc/sdca/sdca_asoc.c"]}],"references":["https://git.kernel.org/stable/c/33387bf9bb6116a0429f823f8dab3accf8f8e09c","https://git.kernel.org/stable/c/1ce42a11bed134903e352010a01fa53073a6b395"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/72xxx/CVE-2026-72415.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72415","state":"PUBLISHED","datePublished":"2026-08-15T05:56:36.210Z","dateUpdated":"2026-10-16T18:55:22.361Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-09T03:40:39.927Z"},"containers":{"cna":{"title":"ASoC: SDCA: Validate written enum value in ge_put_enum_double()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SDCA: Validate written enum value in ge_put_enum_double()\n\nge_put_enum_double() passes the user-supplied enumeration index\nitem[0] to snd_soc_enum_item_to_val() without checking it against the\nnumber of items in the enum:\n\n\tret = snd_soc_enum_item_to_val(e, item[0]);\n\nsnd_soc_enum_item_to_val() indexes the heap-allocated e->values[] array\nwith that index (e->values is set from a devm_kcalloc() of e->items\nentries), so a control write with an out-of-range item[0] reads past the\nend of the values buffer.  The bounds check in\nsnd_soc_dapm_put_enum_double() only runs afterwards, so it does not\nprevent the read here.\n\nReject an out-of-range item before using it, matching the other enum put\nhandlers.\n\nThis issue was pointed out by the Sashiko AI review bot while reviewing a\nrelated enum-validation series:\nhttps://lore.kernel.org/all/20260609125735.CEB651F00893@smtp.kernel.org/"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"812ff1baa764080ba37bb0729e0c23c0e869b542","status":"affected","lessThan":"33387bf9bb6116a0429f823f8dab3accf8f8e09c","versionType":"git"},{"version":"812ff1baa764080ba37bb0729e0c23c0e869b542","status":"affected","lessThan":"1ce42a11bed134903e352010a01fa53073a6b395","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/soc/sdca/sdca_asoc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"7.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.0","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/soc/sdca/sdca_asoc.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/33387bf9bb6116a0429f823f8dab3accf8f8e09c"},{"url":"https://git.kernel.org/stable/c/1ce42a11bed134903e352010a01fa53073a6b395"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is reached only via a local ALSA mixer control write (SNDRV_CTL_IOCTL_ELEM_WRITE on /dev/snd/controlC*) to the SDCA Group Entity \"Selected Mode\" enum exposed by ge_put_enum_double(); there is no network, Bluetooth, or physical-bus packet path to this handler.\nAC:L - An attacker can reliably issue a control write with an out-of-range enumerated index; the only extra condition is detected jack mode >2, which is satisfied by plugging a headset into the affected laptop's audio jack on typical SDCA-equipped systems.\nPR:L - Exploitation requires only local access to the ALSA control device, which on standard desktop and laptop distributions is available to unprivileged users in the audio group without CAP_SYS_ADMIN or init-namespace root.\nUI:N - No action by a separate victim is required; the attacker triggers the vulnerable put handler directly through their own ioctl or mixer-tool write to the affected control.\nS:U - The out-of-bounds read corrupts kernel heap metadata or leaks adjacent kernel memory within the same kernel security boundary; it does not by itself cross VM, container, or IOMMU isolation boundaries.\nC:H - snd_soc_enum_item_to_val() indexes the heap-allocated e->values[] array with attacker-controlled item[0] before any bounds check, enabling an out-of-bounds kernel heap read that can disclose adjacent sensitive kernel memory contents.\nI:N - The defect is an out-of-bounds read only; snd_soc_dapm_put_enum_double() still rejects invalid indices before any register write, so the bug does not directly modify kernel memory or achieve arbitrary write or code execution.\nA:H - A sufficiently large out-of-range enum index can read far beyond the small devm_kcalloc()-allocated values buffer and fault on unmapped kernel memory, causing a kernel oops or panic and denial of service on affected SDCA audio systems."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T05:43:55.069Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-72415","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T18:49:15.372697Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T18:55:22.361Z"}}]}}}