CVE-2026-72415

A flaw was found in the Linux kernel. In the Advanced Linux Sound Architecture System on Chip (ASoC) Sound Driver Component Architecture (SDCA) component, the ge_put_enum_double() function fails to validate a user-supplied enumeration index. This oversight allows a local attacker to provide an out-of-range index, resulting in an out-of-bounds read from the e->values[] array. This could lead to information disclosure.

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because exploitation requires local access and is constrained to systems running the Sound Driver Component Architecture (SDCA) subsystem. The issue cannot be exploited remotely and is limited to hardware configurations with active SDCA audio controls. On exposed setups, an unprivileged local user could potentially trigger a kernel crash or expose kernel memory, while typical enterprise server deployments without active audio hardware remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.