Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-72483— usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 3.16版本存在安全漏洞，该漏洞源于max3421_hub_control函数处理USB集线器类请求时未验证请求的value参数是否超过移位宽度，恶意用户空间任务可通过/dev/bus/usb/.../001设备发出USBDEVFS_CONTROL ioctl触发移位越界，导致任意位损坏，从而绕过内部状态检查并混淆集线器状态。

CVSS 7.8 · High EPSS 0.19% · P9

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 2d53139f31626bad6f8983d8e519ddde2cbba921< e5fa9d8f40746ec3447335c9642c03410f5fd3af affected
2d53139f31626bad6f8983d8e519ddde2cbba921< 08b1d4cab0230697bc74c63fc4e40170a7559c54 affected
2d53139f31626bad6f8983d8e519ddde2cbba921< 3be5f24e8270ba53b3c814d13689bb8644c86237 affected
2d53139f31626bad6f8983d8e519ddde2cbba921< d512bdefd241b98f4d7bcb5bab5614a86411fad4 affected
2d53139f31626bad6f8983d8e519ddde2cbba921< 00dd025324b56d39d37e57a08f473dab3a660f30 affected
2d53139f31626bad6f8983d8e519ddde2cbba921< 02d03c61e8a7b016956acb48e8a2512d16d87517 affected
2d53139f31626bad6f8983d8e519ddde2cbba921< 4da073d57176d8e1c2bca34febfbc81d2560c1a5 affected
2d53139f31626bad6f8983d8e519ddde2cbba921< cff06b03b530ae1fe8a13e93a7848f2130e00fb4 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-72483

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() The `max3421_hub_control()` function handles USB hub class requests to the virtual root hub. In the `default` branches of both the `ClearPortFeature` and `SetPortFeature` switch statements, it modifies `max3421_hcd->port_status` by left shifting 1 by the request's `value` parameter. However, it does not validate whether this shift will exceed the width of `port_status`. So if a malicious userspace task with access to the root hub via /dev/bus/usb/.../001 issues a USBDEVFS_CONTROL ioctl with `wValue` greater than or equal to 32, the left shift operation invokes shift-out-of-bounds undefined behavior. This results in arbitrary bit corruption of `port_status`, including the normally-immutable change bits, which can bypass internal state checks and confuse the hub status. Fix this by rejecting requests whose `value` exceeds the shift width before performing the shift. This issue was found using a KLEE-based symbolic execution tool for kernel drivers that I'm currently developing.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 3.16版本存在安全漏洞，该漏洞源于max3421_hub_control函数处理USB集线器类请求时未验证请求的value参数是否超过移位宽度，恶意用户空间任务可通过/dev/bus/usb/.../001设备发出USBDEVFS_CONTROL ioctl触发移位越界，导致任意位损坏，从而绕过内部状态检查并混淆集线器状态。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 2d53139f31626bad6f8983d8e519ddde2cbba921 ~ e5fa9d8f40746ec3447335c9642c03410f5fd3af -
Linux Linux 3.16 -

II. Public POCs for CVE-2026-72483

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-72483

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-72483 (8)

Same Patch Batch · Linux · 2026-08-15 · 844 CVEs total

CVE-2026-74280 10.0 CRITICAL crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
CVE-2026-74279 10.0 CRITICAL crypto: cavium/cpt - fix DMA cleanup using wrong loop index
CVE-2026-74475 10.0 CRITICAL vxlan: use neigh_ha_snapshot() in route_shortcircuit()
CVE-2026-72421 10.0 CRITICAL ipv4: fib: Don't ignore error route in local/main tables.
CVE-2026-74309 10.0 CRITICAL vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
CVE-2026-72407 10.0 CRITICAL geneve: validate inner network offset in geneve_gro_complete()
CVE-2026-72408 10.0 CRITICAL geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
CVE-2026-72493 9.9 CRITICAL net: serialize netif_running() check in enqueue_to_backlog()
CVE-2026-72319 9.8 CRITICAL ipvs: ensure inner headers in ICMP errors are in headroom
CVE-2026-72220 9.8 CRITICAL sunrpc: harden rq_procinfo lifecycle to prevent double-free
CVE-2026-72217 9.8 CRITICAL SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
CVE-2026-74384 9.8 CRITICAL nvme-multipath: fix flex array size in struct nvme_ns_head
CVE-2026-72299 9.8 CRITICAL tipc: restrict socket queue dumps in enqueue tracepoints
CVE-2026-72210 9.8 CRITICAL ntfs: fix off-by-one in mapping pairs decoding bounds checks
CVE-2026-72211 9.8 CRITICAL ntfs: grow index root value before reparent header update
CVE-2026-72317 9.8 CRITICAL SUNRPC: pin upper rpc_clnt across the TLS connect_worker
CVE-2026-72209 9.8 CRITICAL ntfs: validate attribute values on lookup
CVE-2026-74268 9.8 CRITICAL tcp: clear sock_ops cb flags before force-closing a child socket
CVE-2026-72207 9.8 CRITICAL ntfs: not change 0-byte $DATA attribute to non-resident
CVE-2026-74267 9.8 CRITICAL net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring q

Showing top 20 of 844 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-72483

No comments yet

Leave a comment