{"id":7065,"date":"2026-09-04T18:49:24","date_gmt":"2026-09-04T10:49:24","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-72415"},"modified":"2026-09-04T18:49:24","modified_gmt":"2026-09-04T10:49:24","slug":"cve-2026-72415","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-72415","title":{"rendered":"CVE-2026-72415 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SDCA: Validate"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ASoC: SDCA: Validate written enum value in ge_put_enum_double()<\/p>\n<p>ge_put_enum_double() passes the user-supplied enumeration index<br \/>\nitem[0] to snd_soc_enum_item_to_val() without checking it against the<br \/>\nnumber of items in the enum:<\/p>\n<p>\tret = snd_soc_enum_item_to_val(e, item[0]);<\/p>\n<p>snd_soc_enum_item_to_val() indexes the heap-allocated e-&gt;values[] array<br \/>\nwith that index (e-&gt;values is set from a devm_kcalloc() of e-&gt;items<br \/>\nentries), so a control write with an out-of-range item[0] reads past the<br \/>\nend of the values buffer.  The bounds check in<br \/>\nsnd_soc_dapm_put_enum_double() only runs afterwards, so it does not<br \/>\nprevent the read here.<\/p>\n<p>Reject an out-of-range item before using it, matching the other enum put<br \/>\nhandlers.<\/p>\n<p>This issue was pointed out by the Sashiko AI review bot while reviewing a<br \/>\nrelated enum-validation series:<br \/>\nhttps:\/\/lore.kernel.org\/all\/20260609125735.CEB651F00893@smtp.kernel.org\/<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ASoC: SDCA: Validate written enum value in ge_put_enum_double()<\/p>\n<p>ge_put_enum_double() passes the user-supplied enumeration index<br \/>\nit<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7065","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7065","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7065"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7065"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7065"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}