## Summary
CVE-2026-72415 is a Linux kernel ASoC SDCA bug where ge_put_enum_double() can read past the end of an enum values buffer when given an out-of-range enumeration index. The issue is triggered via a local control write and fixed by validating item[0] against e->items before indexing.
## Technical Details
- Root cause: ge_put_enum_double() calls snd_soc_enum_item_to_val(e, item[0]) using the user-supplied item[0] without checking it against the enum’s item count.
- Memory safety flaw: snd_soc_enum_item_to_val() indexes e->values[] using item[0]. Since e->values is allocated for e->items entries (via devm_kcalloc()), an out-of-range item[0] causes an out-of-bounds read.
- Why existing checks didn’t help: the bounds check in snd_soc_dapm_put_enum_double() occurs only *after* the unsafe read, so it does not prevent the out-of-bounds access.
- Fix: add a pre-check in ge_put_enum_double():
- if (item[0] >= e->items) return -EINVAL;
- Code location: sound/soc/sdca/sdca_asoc.c (function ge_put_enum_double()).
## Affected
- Linux kernel ASoC SDCA code path containing ge_put_enum_double() in sound/soc/sdca/sdca_asoc.c.
- The upstream fix is associated with commit 1ce42a11bed134903e352010a01fa53073a6b395 (and stable backport 33387bf9bb6116a0429f823f8dab3accf8f8e09c).
## Impact
- Out-of-bounds read from heap-allocated e->values[] due to an unchecked enum index.
- CVSS indicates local attack vector and high severity, with confidentiality and availability impact (C:H, A:H) and no integrity impact (I:N).
## Mitigation
1. Patch immediately with the fix that adds item[0] bounds validation in ge_put_enum_double() (commits 1ce42a11bed134903e352010a01fa53073a6b395 / 33387bf9bb6116a0429f823f8dab3accf8f8e09c).
2. If patching is delayed, restrict access to the relevant local control interface that can write the enum value (the advisory describes the issue as reachable via a control write).
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H