Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-72483— usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()

CVSS 7.8 · High EPSS 0.18% · P8

Affected Version Matrix 18

VendorProductVersion RangeStatus
LinuxLinux2d53139f31626bad6f8983d8e519ddde2cbba921< e5fa9d8f40746ec3447335c9642c03410f5fd3afaffected
2d53139f31626bad6f8983d8e519ddde2cbba921< 08b1d4cab0230697bc74c63fc4e40170a7559c54affected
2d53139f31626bad6f8983d8e519ddde2cbba921< 3be5f24e8270ba53b3c814d13689bb8644c86237affected
2d53139f31626bad6f8983d8e519ddde2cbba921< d512bdefd241b98f4d7bcb5bab5614a86411fad4affected
2d53139f31626bad6f8983d8e519ddde2cbba921< 00dd025324b56d39d37e57a08f473dab3a660f30affected
2d53139f31626bad6f8983d8e519ddde2cbba921< 02d03c61e8a7b016956acb48e8a2512d16d87517affected
2d53139f31626bad6f8983d8e519ddde2cbba921< 4da073d57176d8e1c2bca34febfbc81d2560c1a5affected
2d53139f31626bad6f8983d8e519ddde2cbba921< cff06b03b530ae1fe8a13e93a7848f2130e00fb4affected
… +10 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-72483

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() The `max3421_hub_control()` function handles USB hub class requests to the virtual root hub. In the `default` branches of both the `ClearPortFeature` and `SetPortFeature` switch statements, it modifies `max3421_hcd->port_status` by left shifting 1 by the request's `value` parameter. However, it does not validate whether this shift will exceed the width of `port_status`. So if a malicious userspace task with access to the root hub via /dev/bus/usb/.../001 issues a USBDEVFS_CONTROL ioctl with `wValue` greater than or equal to 32, the left shift operation invokes shift-out-of-bounds undefined behavior. This results in arbitrary bit corruption of `port_status`, including the normally-immutable change bits, which can bypass internal state checks and confuse the hub status. Fix this by rejecting requests whose `value` exceeds the shift width before performing the shift. This issue was found using a KLEE-based symbolic execution tool for kernel drivers that I'm currently developing.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 2d53139f31626bad6f8983d8e519ddde2cbba921 ~ e5fa9d8f40746ec3447335c9642c03410f5fd3af -
LinuxLinux 3.16 -

II. Public POCs for CVE-2026-72483

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-72483

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-72483 (8)

Same Patch Batch · Linux · 2026-08-15 · 846 CVEs total

CVE-2026-7428010.0 CRITICALcrypto: marvell/octeontx - fix DMA cleanup using wrong loop index
CVE-2026-7427910.0 CRITICALcrypto: cavium/cpt - fix DMA cleanup using wrong loop index
CVE-2026-7240710.0 CRITICALgeneve: validate inner network offset in geneve_gro_complete()
CVE-2026-7240810.0 CRITICALgeneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
CVE-2026-7430910.0 CRITICALvdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
CVE-2026-7447510.0 CRITICALvxlan: use neigh_ha_snapshot() in route_shortcircuit()
CVE-2026-7242110.0 CRITICALipv4: fib: Don't ignore error route in local/main tables.
CVE-2026-724939.9 CRITICALnet: serialize netif_running() check in enqueue_to_backlog()
CVE-2026-724639.8 CRITICALxfrm: Fix dev use-after-free in xfrm async resumption
CVE-2026-722489.8 CRITICALnetfilter: flowtable: support IPIP tunnel with direct xmit
CVE-2026-723819.8 CRITICALksmbd: fix use-after-free of fp->owner.name in durable handle owner check
CVE-2026-724779.8 CRITICALfs/ntfs3: call _ntfs_bad_inode() when failing to rename
CVE-2026-724739.8 CRITICALxprtrdma: Decouple req recycling from RPC completion
CVE-2026-724729.8 CRITICALnfs: use nfsi->rwsem to protect traversal of the file lock list
CVE-2026-744069.8 CRITICALvxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
CVE-2026-722229.8 CRITICALsunrpc: pin svc_xprt across the asynchronous TLS handshake callback
CVE-2026-721379.8 CRITICALxfrm: nat_keepalive: avoid double free on send error
CVE-2026-722269.8 CRITICALbatman-adv: tt: prevent TVLV OOB check overflow
CVE-2026-743769.8 CRITICALmd/raid10: reset read_slot when reusing r10bio for discard
CVE-2026-722349.8 CRITICALbatman-adv: access unicast_ttvn skb->data only after skb realloc

Showing top 20 of 846 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-72483

No comments yet

Leave a comment