CVE-2026-72483

usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Aug 17, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()

The `max3421_hub_control()` function handles USB hub class requests to the virtual root hub. In the `default` branches of both the `ClearPortFeature` and `SetPortFeature` switch statements, it modifies `max3421_hcd->port_status` by left shifting 1 by the request's `value` parameter. However, it does not validate whether this shift will exceed the width of `port_status`.

So if a malicious userspace task with access to the root hub via /dev/bus/usb/.../001 issues a USBDEVFS_CONTROL ioctl with `wValue` greater than or equal to 32, the left shift operation invokes shift-out-of-bounds undefined behavior. This results in arbitrary bit corruption of `port_status`, including the normally-immutable change bits, which can bypass internal state checks and confuse the hub status.

Fix this by rejecting requests whose `value` exceeds the shift width before performing the shift.

This issue was found using a KLEE-based symbolic execution tool for kernel drivers that I'm currently developing.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2d53139f31626bad6f8983d8e519ddde2cbba921 to before e5fa9d8f40746ec3447335c9642c03410f5fd3afAffected 2d53139f31626bad6f8983d8e519ddde2cbba921 to before 08b1d4cab0230697bc74c63fc4e40170a7559c54Affected 2d53139f31626bad6f8983d8e519ddde2cbba921 to before 3be5f24e8270ba53b3c814d13689bb8644c86237Affected 2d53139f31626bad6f8983d8e519ddde2cbba921 to before d512bdefd241b98f4d7bcb5bab5614a86411fad4Affected 2d53139f31626bad6f8983d8e519ddde2cbba921 to before 00dd025324b56d39d37e57a08f473dab3a660f30Affected 2d53139f31626bad6f8983d8e519ddde2cbba921 to before 02d03c61e8a7b016956acb48e8a2512d16d87517Affected 2d53139f31626bad6f8983d8e519ddde2cbba921 to before 4da073d57176d8e1c2bca34febfbc81d2560c1a5Affected 2d53139f31626bad6f8983d8e519ddde2cbba921 to before cff06b03b530ae1fe8a13e93a7848f2130e00fb4Affected
LinuxLinux	3.16Affected before 3.16Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

2d53139f31626bad6f8983d8e519ddde2cbba921 to before e5fa9d8f40746ec3447335c9642c03410f5fd3afAffected
2d53139f31626bad6f8983d8e519ddde2cbba921 to before 08b1d4cab0230697bc74c63fc4e40170a7559c54Affected
2d53139f31626bad6f8983d8e519ddde2cbba921 to before 3be5f24e8270ba53b3c814d13689bb8644c86237Affected
2d53139f31626bad6f8983d8e519ddde2cbba921 to before d512bdefd241b98f4d7bcb5bab5614a86411fad4Affected
2d53139f31626bad6f8983d8e519ddde2cbba921 to before 00dd025324b56d39d37e57a08f473dab3a660f30Affected
2d53139f31626bad6f8983d8e519ddde2cbba921 to before 02d03c61e8a7b016956acb48e8a2512d16d87517Affected
2d53139f31626bad6f8983d8e519ddde2cbba921 to before 4da073d57176d8e1c2bca34febfbc81d2560c1a5Affected
2d53139f31626bad6f8983d8e519ddde2cbba921 to before cff06b03b530ae1fe8a13e93a7848f2130e00fb4Affected

LinuxLinux

3.16Affected
before 3.16Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.