CVE-2026-72415 Linux CVE debrief

Who should care

Linux kernel developers and users, ASoC SDCA component users, and security teams responsible for vulnerability management and patching should be aware of this vulnerability and take necessary actions to mitigate it. The vulnerability affects the Linux kernel's ASoC SDCA component, and users of this component should review and apply the patch to the Linux kernel. Additionally, operators and platform administrators should be aware of the potential impact on their systems and take steps to verify and mitigate the vulnerability.

Technical summary

The ge_put_enum_double() function in the Linux kernel's ASoC SDCA component does not validate the user-supplied enumeration index before passing it to snd_soc_enum_item_to_val(). This can lead to reading past the end of the values buffer. The issue has been resolved by adding a bounds check to reject out-of-range items before using them. The affected product is the Linux kernel, and the vulnerability has a medium defensive priority. The technical impact is that an attacker could potentially exploit this vulnerability to read past the end of the values buffer, which could lead to a denial of service or other unspecified impacts.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to the Linux kernel
• Validate user-supplied enumeration indices in the ge_put_enum_double() function
• Monitor for potential exploits of this vulnerability
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was pointed out by the Sashiko AI review bot while reviewing a related enum-validation series. The issue is in the ge_put_enum_double() function, which does not validate the user-supplied enumeration index before using it. To verify, defenders should review the Linux kernel's ASoC SDCA component and check for potential exploits of this vulnerability. The Sashiko AI review bot's findings indicate that the ge_put_enum_double() function passes the user-supplied enumeration index item[0] to snd_soc_enum_item_to_val() without checking it against the number of items in the enum. This can lead to reading past the end of the values buffer. The bounds check in snd_soc_dapm_put_enum_double() only runs afterwards, so it does not prevent the read here. The issue has been resolved by adding a bounds check to reject out-of-range items before using them.

Official resources