What is the CVSS score of CVE-2026-72415?

CVE-2026-72415 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72415?

CVE-2026-72415 affects the Linux kernel ASoC SDCA subsystem, enabling local users with low privileges to read unauthorized kernel heap memory.. A patch is available.

How to fix or mitigate CVE-2026-72415?

Within 24 hours, identify all systems running Linux kernels from commit 812ff1baa764 through versions prior to 7.1.5, prioritizing machines with multiple user accounts or untrusted network access. Within 7 days, obtain and test the vendor-released kernel patch in a staging environment that mirrors your production configuration. Within 30 days, deploy the patched kernel across all affected systems, schedule maintenance windows for reboot, and verify system stability and application functionality post-deployment.

Linux Kernel CVE-2026-72415

EUVD-2026-59314 HIGH

2026-08-15 Linux

GHSA-cq9w-mfcc-7q5j

Information Disclosure Linux Red Hat Suse

7.1

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

7.1 HIGH

Local access with low privileges required to write ALSA controls; no integrity impact as only a read primitive exists.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 09:13 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.1 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:56 cve.org

HIGH 7.1

CVE Published

Aug 15, 2026 - 05:56 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SDCA: Validate written enum value in ge_put_enum_double()

ge_put_enum_double() passes the user-supplied enumeration index item[0] to snd_soc_enum_item_to_val() without checking it against the number of items in the enum:

ret = snd_soc_enum_item_to_val(e, item[0]);

snd_soc_enum_item_to_val() indexes the heap-allocated e->values[] array with that index (e->values is set from a devm_kcalloc() of e->items entries), so a control write with an out-of-range item[0] reads past the end of the values buffer. The bounds check in snd_soc_dapm_put_enum_double() only runs afterwards, so it does not prevent the read here.

Reject an out-of-range item before using it, matching the other enum put handlers.

This issue was pointed out by the Sashiko AI review bot while reviewing a related enum-validation series: https://lore.kernel.org/all/20260609125735.CEB651F00893@smtp.kernel.org/

AnalysisAI

Out-of-bounds heap read in the Linux kernel ASoC SDCA subsystem allows a local attacker with low privileges to read past the end of a kernel heap buffer by writing an out-of-range enumeration index to the ge_put_enum_double() ALSA control handler. Affected kernels from commit 812ff1baa764 through pre-7.1.5 are vulnerable; the existing bounds check in snd_soc_dapm_put_enum_double() runs only after the unsafe read, providing no protection. No public exploit code has been identified and no active exploitation is confirmed; EPSS of 0.20% (10th percentile) reflects low near-term exploitation probability.

Technical ContextAI

The vulnerability resides in the ASoC (Audio System on Chip) SDCA (SoundWire Device Class Audio) subsystem within the Linux kernel, specifically in ge_put_enum_double(), an ALSA sound control write handler. The e->values[] array is heap-allocated by devm_kcalloc() with exactly e->items entries. When a user writes a control value, item[0] is the caller-supplied enumeration index, which is fed directly to snd_soc_enum_item_to_val() - which indexes e->values[item[0]] without prior validation. A value of item[0] >= e->items causes a read beyond the allocated buffer. Sibling put handlers (e.g., snd_soc_dapm_put_enum_double()) perform the bounds check before using the index; ge_put_enum_double() was missing this guard. The root cause maps to CWE-125 (Out-of-bounds Read), though no CWE is formally assigned in the input data. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. The flaw requires SoundWire SDCA-capable audio hardware and the corresponding ASoC SDCA driver to be loaded and active.

RemediationAI

Update to Linux kernel 7.1.5 (stable) or 7.2-rc1 and later (mainline), which contain the upstream fix adding a bounds check on item[0] before passing it to snd_soc_enum_item_to_val(). Stable-tree patches are available at https://git.kernel.org/stable/c/33387bf9bb6116a0429f823f8dab3accf8f8e09c and https://git.kernel.org/stable/c/1ce42a11bed134903e352010a01fa53073a6b395. Distribution maintainers running kernels in the affected commit range should backport these commits. As a compensating control where patching is not immediately feasible, restrict write access to ALSA sound control interfaces by tightening udev rules or removing users from the audio group - for example, setting mode 0640 on /dev/snd/controlC* owned by root:audio and removing non-administrator accounts from the audio group. This trades off audio functionality for non-privileged users but eliminates the attack surface on affected systems. Systems without SoundWire SDCA hardware or without the ASoC SDCA kernel module loaded are not affected and require no mitigation.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72415 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72415

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code