CVE-2026-72415
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Validate written enum value in ge_put_enum_double() ge_put_enum_double() passes the user-supplied enumeration index item[0] to snd_soc_enum_item_to_val() without checking it against the number of items in the enum: ret = snd_soc_enum_item_to_val(e, item[0]); snd_soc_enum_item_to_val() indexes the heap-allocated e->values[] array with that index (e->values is set from a devm_kcalloc() of e->items entries), so a control write with an out-of-range item[0] reads past the end of the values buffer. The bounds check in snd_soc_dapm_put_enum_double() only runs afterwards, so it does not prevent the read here. Reject an out-of-range item before using it, matching the other enum put handlers. This issue was pointed out by the Sashiko AI review bot while reviewing a related enum-validation series: https://lore.kernel.org/all/20260609125735.CEB651F00893@smtp.kernel.org/

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72415
EUVD
EUVD-2026-59314

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's ASoC SDCA subsystem. It involves a function ge_put_enum_double() that writes an enumeration value without validating if the user-supplied index is within bounds. This can lead to reading past the end of a heap-allocated array, causing potential memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's ASoC SDCA subsystem and requires kernel-level access to detect. Check if your kernel version includes the affected code by examining the ge_put_enum_double() function in the sound/soc/codecs/sdca/sdca.c file. Use commands like 'uname -a' to check kernel version and 'grep -r ge_put_enum_double() /usr/src/linux*' to locate the function.

Impact Analysis

If exploited, this flaw could allow an attacker to cause a denial of service (system crash) or potentially execute arbitrary code with kernel privileges. It may also lead to memory corruption or instability in systems using the affected Linux kernel components.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution to ensure the fix for CVE-2026-72415 is included. If patches are unavailable, consider disabling the affected ASoC SDCA functionality or restricting access to sound device controls until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72415. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart