ASoC: SDCA: Validate written enum value in ge_put_enum_double() (Linux Linux)

CVE-2026-72415
HIGH 7.1

At a glance

Source
NVD
EPSS
EPSS 0.16 % · percentile 5 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Received

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Validate written enum value in ge_put_enum_double() ge_put_enum_double() passes the user-supplied enumeration index item[0] to snd_soc_enum_item_to_val() without checking it against the number of items in the enum: ret = snd_soc_enum_item_to_val(e, item[0]); snd_soc_enum_item_to_val() indexes the heap-allocated e->values[] array with that index (e->values is set from a devm_kcalloc() of e->items entries), so a control write with an out-of-range item[0] reads past the end of the values buffer. The bounds check in snd_soc_dapm_put_enum_double() only runs afterwards, so it does not prevent the read here. Reject an out-of-range item before using it, matching the other enum put handlers. This issue was pointed out by the Sashiko AI review bot while reviewing a related enum-validation series: https://lore.kernel.org/all/20260609125735.CEB651F00893@smtp.kernel.org/

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HLinux
CVSS 3.1HIGH 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)

European references

CERT-FR advisories

Affected products

ProductVersions
Linux · Linuxaffected 812ff1baa764080ba37bb0729e0c23c0e869b542 < 33387bf9bb6116a0429f823f8dab3accf8f8e09c ; affected 812ff1baa764080ba37bb0729e0c23c0e869b542 < 1ce42a11bed134903e352010a01fa53073a6b395
Linux · Linuxaffected 7.0 ; unaffected 0 < 7.0 ; unaffected 7.1.5 ≤ 7.1.* ; unaffected 7.2 ≤ *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD