CVE-2026-72483
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In the Linux kernel, the USB host max3421 driver has a shift-out-of-bounds vulnerability in max3421_hub_control(). An untrusted userspace process can send a USBDEVFS_CONTROL request with wValue greater than or equal to 32, causing an out-of-bounds bit shift and corrupting port_status, including immutable bits. The fix rejects requests with a value exceeding the shift width.
Risk Assessment
The vulnerability allows a local attacker with access to the root hub to corrupt port state, potentially leading to malfunction of USB devices or possibly privilege escalation.
Recommendation
Install the patch from the Linux kernel that adds validation of the value before shifting. Update the kernel to a patched version.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() The `max3421_hub_control()` function handles USB hub class requests to the virtual root hub. In the `default` branches of both the `ClearPortFeature` and `SetPortFeature` switch statements, it modifies `max3421_hcd->port_status` by left shifting 1 by the request's `value` parameter. However, it does not validate whether this shift will exceed the width of `port_status`. So if a malicious userspace task with access to the root hub via /dev/bus/usb/.../001 issues a USBDEVFS_CONTROL ioctl with `wValue` greater than or equal to 32, the left shift operation invokes shift-out-of-bounds undefined behavior. This results in arbitrary bit corruption of `port_status`, including the normally-immutable change bits, which can bypass internal state checks and confuse the hub status. Fix this by rejecting requests whose `value` exceeds the shift width before performing the shift. This issue was found using a KLEE-based symbolic execution tool for kernel drivers that I'm currently developing.