In the Linux kernel, the following vulnerability has been resolved:

ASoC: SDCA: Validate written enum value in ge_put_enum_double()

ge_put_enum_double() passes the user-supplied enumeration index
item[0] to snd_soc_enum_item_to_val() without checking it against the
number of items in the enum:

	ret = snd_soc_enum_item_to_val(e, item[0]);

snd_soc_enum_item_to_val() indexes the heap-allocated e->values[] array
with that index (e->values is set from a devm_kcalloc() of e->items
entries), so a control write with an out-of-range item[0] reads past the
end of the values buffer.  The bounds check in
snd_soc_dapm_put_enum_double() only runs afterwards, so it does not
prevent the read here.

Reject an out-of-range item before using it, matching the other enum put
handlers.

This issue was pointed out by the Sashiko AI review bot while reviewing a
related enum-validation series:
https://lore.kernel.org/all/[email protected]/

https://git.kernel.org/stable/c/1ce42a11bed134903e352010a01fa53073a6b395

https://git.kernel.org/stable/c/33387bf9bb6116a0429f823f8dab3accf8f8e09c

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/soc/sdca/sdca_asoc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"812ff1baa764080ba37bb0729e0c23c0e869b542","lessThan":"33387bf9bb6116a0429f823f8dab3accf8f8e09c","versionType":"git","status":"affected"},{"version":"812ff1baa764080ba37bb0729e0c23c0e869b542","lessThan":"1ce42a11bed134903e352010a01fa53073a6b395","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/soc/sdca/sdca_asoc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]