{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-72483",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-72483"
  ],
  "published": "2026-08-15T06:04:33Z",
  "summary": "usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()\n\nThe `max3421_hub_control()` function handles USB hub class requests\nto the virtual root hub. In the `default` branches of both the\n`ClearPortFeature` and `SetPortFeature` switch statements, it modifies\n`max3421_hcd->port_status` by left shifting 1 by the request's `value`\nparameter. However, it does not validate whether this shift will exceed\nthe width of `port_status`.\n\nSo if a malicious userspace task with access to the root hub via\n/dev/bus/usb/.../001 issues a USBDEVFS_CONTROL ioctl with `wValue`\ngreater than or equal to 32, the left shift operation invokes\nshift-out-of-bounds undefined behavior. This results in arbitrary\nbit corruption of `port_status`, including the normally-immutable\nchange bits, which can bypass internal state checks and confuse the\nhub status.\n\nFix this by rejecting requests whose `value` exceeds the shift width\nbefore performing the shift.\n\nThis issue was found using a KLEE-based symbolic execution tool for\nkernel drivers that I'm currently developing.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.178",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72483"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/e5fa9d8f40746ec3447335c9642c03410f5fd3af"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/08b1d4cab0230697bc74c63fc4e40170a7559c54"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/3be5f24e8270ba53b3c814d13689bb8644c86237"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d512bdefd241b98f4d7bcb5bab5614a86411fad4"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/00dd025324b56d39d37e57a08f473dab3a660f30"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/02d03c61e8a7b016956acb48e8a2512d16d87517"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4da073d57176d8e1c2bca34febfbc81d2560c1a5"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/cff06b03b530ae1fe8a13e93a7848f2130e00fb4"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-17T05:50:24Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The bug is reached when a local process issues USBDEVFS_CONTROL on the MAX3421 root hub (/dev/bus/usb/BBB/001); usb_submit_urb() routes ep0 control transfers through rh_call_control() to max3421_hub_control(), with no network or remote protocol path.\nAC:L - The attacker fully controls the hub-class wValue field in the ioctl and can reliably trigger the shift-out-of-bounds by sending SetPortFeature or ClearPortFeature with wValue>=32; no race, timing, or memory-layout conditions outside the attacker's control are required.\nPR:L - Only a basic unprivileged local account is needed: desktop, kiosk, and embedded MAX3421 deployments grant USB bus device-node access via udev uaccess/ACL or plugdev, and check_ctrlrecip() imposes no extra capability check for hub-class (USB_RECIP_OTHER) root-hub requests.\nUI:N - Exploitation is self-contained in the attacker's own process issuing the crafted USBDEVFS_CONTROL ioctl; no separate victim action, mount, or file open by another user is required.\nS:U - The undefined-behavior shift corrupts only the MAX3421 driver's port_status state inside kernel memory under the same security authority; it does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Shift-out-of-bounds on port_status is kernel memory corruption of a security-relevant hub state word; corrupted status (including normally kernel-only change bits) is returned to userspace via GetPortStatus, enabling information disclosure from corrupted kernel state.\nI:H - The unchecked shift allows arbitrary bit manipulation of port_status, including normally immutable change bits, bypassing the USB_PORT_STAT_POWER gate that guards SetPortFeature updates and corrupting hub state that drives VBUS control and port reset logic.\nA:H - Shift-out-of-bounds is undefined behavior that can trap under UBSAN/KASAN or panic_on_warn, and corrupting port_status can confuse hub status polling, suspend/resume, and port-reset handling, causing USB host failure or kernel hang on embedded MAX3421 systems."
    }
  }
}