In the ALSA System on Chip (ASoC) SDCA driver for the Linux kernel, the helper function ge_put_enum_double() forwards a user‑supplied enumeration index directly to snd_soc_enum_item_to_val() without first validating that the index falls within the bounds of the enum's value table. Because snd_soc_enum_item_to_val() accesses an array allocated for the enum values, an out‑of‑range index causes the kernel to read past the end of that buffer, leaking arbitrary kernel memory contents. The flaw does not immediately grant code execution but allows a privileged attacker to read sensitive data residing in kernel space.

Any Linux kernel that includes the ASoC SDCA driver and has not incorporated the patch commits 1ce42a11bd… and 33387bf9bb… is vulnerable. This includes all upstream kernel releases that predate those commits and any downstream distributions that ship the same unpatched kernel versions. Systems with the SDCA driver enabled in the default configuration, or those that load it as a module, are at risk if an attacker can write to an audio control interface.

The reported CVSS score of 7.1 classifies it as high severity, mainly for its impact on confidentiality. The EPSS score of <1 % indicates a very low probability of exploitation at the time of analysis, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local write access to the audio control interface, which typically means possessing the same privileges as the user interacting with sound or having the ability to load kernel modules. Without such privileges, the attack vector is limited, but once the capability is available the out‑of‑bounds read provides direct information disclosure from kernel memory.