CVE-2026-72483

Received Received - Intake

Buffer Overflow in Linux Kernel USB Host Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() The `max3421_hub_control()` function handles USB hub class requests to the virtual root hub. In the `default` branches of both the `ClearPortFeature` and `SetPortFeature` switch statements, it modifies `max3421_hcd->port_status` by left shifting 1 by the request's `value` parameter. However, it does not validate whether this shift will exceed the width of `port_status`. So if a malicious userspace task with access to the root hub via /dev/bus/usb/.../001 issues a USBDEVFS_CONTROL ioctl with `wValue` greater than or equal to 32, the left shift operation invokes shift-out-of-bounds undefined behavior. This results in arbitrary bit corruption of `port_status`, including the normally-immutable change bits, which can bypass internal state checks and confuse the hub status. Fix this by rejecting requests whose `value` exceeds the shift width before performing the shift. This issue was found using a KLEE-based symbolic execution tool for kernel drivers that I'm currently developing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72483

EUVD

EUVD-2026-59382

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a shift-out-of-bounds vulnerability in the Linux kernel's USB host driver for the MAX3421 chip. The function max3421_hub_control() handles USB hub requests but fails to validate the wValue parameter before left-shifting it to modify port_status. If wValue is 32 or higher, the shift exceeds the bit width of port_status, causing undefined behavior and arbitrary bit corruption in port_status, including normally protected bits.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB host driver (max3421) and requires local access to the affected system. Detection involves checking kernel logs for related errors or using static analysis tools on the kernel source code. No direct network detection commands are applicable.

Impact Analysis

An attacker with access to /dev/bus/usb could exploit this to corrupt the hub's internal state. This might cause the system to misinterpret USB device connections or disconnections, potentially leading to denial of service, device unavailability, or unexpected behavior in connected USB devices.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a low-level kernel issue involving bit corruption in USB hub status handling. No evidence suggests it impacts data protection or privacy controls required by these standards.

Mitigation Strategies

Apply the latest kernel patch from your Linux distribution that fixes the max3421_hub_control() issue. If no patch is available, restrict access to /dev/bus/usb devices to prevent malicious userspace tasks from exploiting this flaw.

Hi! I’m here to help you understand CVE-2026-72483. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70