Skip to main content

Linux Kernel CVE-2026-72483

| EUVDEUVD-2026-59382 HIGH
2026-08-15 Linux GHSA-fc4h-xff9-jp24
Buffer Overflow Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local device-node access requires PR:L and AV:L; UB-driven kernel state corruption justifies C:H/I:H/A:H; no scope change as impact stays within the kernel/USB subsystem.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:48 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:57 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 05:57 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()

The max3421_hub_control() function handles USB hub class requests to the virtual root hub. In the default branches of both the ClearPortFeature and SetPortFeature switch statements, it modifies max3421_hcd->port_status by left shifting 1 by the request's value parameter. However, it does not validate whether this shift will exceed the width of port_status.

So if a malicious userspace task with access to the root hub via /dev/bus/usb/.../001 issues a USBDEVFS_CONTROL ioctl with wValue greater than or equal to 32, the left shift operation invokes shift-out-of-bounds undefined behavior. This results in arbitrary bit corruption of port_status, including the normally-immutable change bits, which can bypass internal state checks and confuse the hub status.

Fix this by rejecting requests whose value exceeds the shift width before performing the shift.

This issue was found using a KLEE-based symbolic execution tool for kernel drivers that I'm currently developing.

AnalysisAI

Shift-out-of-bounds undefined behavior in the Linux kernel's MAX3421E USB host controller driver (max3421-hcd) allows a local low-privileged user with access to the raw USB device node to corrupt kernel hub state. The max3421_hub_control() function blindly shifts the integer constant 1 left by an attacker-controlled wValue field without bounds-checking, so any value ≥ 32 invokes undefined behavior that arbitrarily corrupts max3421_hcd->port_status, including immutable change bits that gate internal state transitions. No public exploit exists and this CVE is not in the CISA KEV catalog; EPSS at 0.25% (16th percentile) reflects low exploitation likelihood, but the CVSS 7.8 is grounded in a genuine local privilege-escalation primitive within the kernel USB subsystem.

Technical ContextAI

The MAX3421E is a MAXIM Integrated (now Analog Devices) USB 2.0 full-speed host controller connected via SPI to the host SoC, commonly found on embedded Linux platforms and single-board computers that lack native USB host hardware. The Linux kernel driver drivers/usb/host/max3421-hcd.c emulates a virtual root hub to integrate the chip into the standard USB stack. The max3421_hub_control() function processes USB hub-class control requests (ClearPortFeature, SetPortFeature) by performing the expression 1 << value where value is the wValue field from the incoming USBDEVFS_CONTROL ioctl - a quantity fully controlled by userspace. Because port_status is a 32-bit field, shifting by ≥ 32 bits is undefined behavior in C, which compilers may optimize in ways that corrupt adjacent memory or produce unpredictable bit patterns. The affected code was introduced at commit 2d53139f31626bad6f8983d8e519ddde2cbba921 (approximately kernel 3.16). No CWE is formally assigned, but the root cause aligns with CWE-1335 (Incorrect Bitwise Shift of Integer) and CWE-20 (Improper Input Validation). CPE: cpe:2.3:a:linux:linux:*.

RemediationAI

Upgrade to a patched Linux kernel stable release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or any 7.2-rc1+ build. Upstream fix commits per stable branch are available at https://git.kernel.org/stable/c/e5fa9d8f40746ec3447335c9642c03410f5fd3af, https://git.kernel.org/stable/c/cff06b03b530ae1fe8a13e93a7848f2130e00fb4, https://git.kernel.org/stable/c/00dd025324b56d39d37e57a08f473dab3a660f30, and the other commits referenced above - apply the one matching your kernel branch. If patching is not immediately possible, restrict raw USB device node access: tighten permissions on /dev/bus/usb/ to deny access to non-root users (e.g., remove the plugdev group's access via udev rules), which eliminates the exploitation path though it breaks userspace USB access for desktop applications. Alternatively, blacklist the max3421-hcd module via /etc/modprobe.d/blacklist-max3421.conf if the hardware is not in active use - this has zero functional impact on systems without the MAX3421E chip and completely removes the attack surface.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-72483 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy