CVE-2026-72483

A flaw was found in the Linux kernel's USB host driver, specifically in the max3421_hub_control() function. A malicious userspace task with access to the root hub can trigger a shift-out-of-bounds vulnerability by issuing a crafted USBDEVFS_CONTROL ioctl. This can lead to arbitrary bit corruption of the port_status, potentially bypassing internal state checks and confusing the hub's operational status.

A moderate severity flaw was found in the Linux kernel MAX3421E USB host controller driver. The max3421_hub_control() function handles USB hub class requests directed at the virtual root hub; in the default branches of its ClearPortFeature and SetPortFeature handling it updates max3421_hcd->port_status by left-shifting 1 by the request's wValue parameter without validating that the shift stays within the width of the variable. A malicious local userspace task with access to the root hub device node (for example /dev/bus/usb/.../001) could exploit this by issuing a crafted USBDEVFS_CONTROL ioctl with wValue greater than or equal to 32, invoking shift-out-of-bounds undefined behavior and corrupting arbitrary bits of port_status, including the normally-immutable change bits. This can bypass internal state checks and confuse the hub status; the demonstrated impact is primarily local denial of service and corruption of USB subsystem internal state, with no concrete information disclosure or privilege escalation primitive shown by the patch context. Red Hat scored this flaw Moderate with CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the upstream CVEORG score of 7.8, because exploitation requires local access to the USB root hub device and the issue is not network reachable, limiting the realistic impact to availability rather than full confidentiality and integrity compromise. All Red Hat Enterprise Linux (including ELS and z streams) and Red Hat In-Vehicle OS kernel and kernel-rt streams are not affected by this flaw because the vulnerable code is not present in the shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.