diff --git a/src/audio/rtnr/rtnr.c b/src/audio/rtnr/rtnr.c
index 45ff62a60f8d..13c4f8d12b4d 100644
--- a/src/audio/rtnr/rtnr.c
+++ b/src/audio/rtnr/rtnr.c
@@ -454,6 +454,11 @@ static int rtnr_get_config(struct processing_module *mod,
 		return rtnr_get_bin_data(mod, cdata, fragment_size);
 
 	case SOF_CTRL_CMD_SWITCH:
+		if (cdata->num_elems > SOF_IPC_MAX_CHANNELS) {
+			comp_err(dev, "num_elems %u > max %u",
+				 cdata->num_elems, SOF_IPC_MAX_CHANNELS);
+			return -EINVAL;
+		}
 		for (j = 0; j < cdata->num_elems; j++) {
 			cdata->chanv[j].channel = j;
 			cdata->chanv[j].value = cd->process_enable;
@@ -560,6 +565,12 @@ static int32_t rtnr_set_value(struct processing_module *mod, void *ctl_data)
 	uint32_t val = 0;
 	int32_t j;
 
+	if (cdata->num_elems > SOF_IPC_MAX_CHANNELS) {
+		comp_err(dev, "num_elems %u > max %u",
+			 cdata->num_elems, SOF_IPC_MAX_CHANNELS);
+		return -EINVAL;
+	}
+
 	for (j = 0; j < cdata->num_elems; j++) {
 		val |= cdata->chanv[j].value;
 		comp_dbg(dev, "value = %u", val);