CVE-2026-72483

The MAX3421 USB host controller driver contains a shift-out-of-bounds vulnerability (CVE-2026-72483) where an unchecked shift operation on `port_status` occurs when `wValue` exceeds 31 in the hub control handler. This is not merely a memory safety issue—it is a state manipulation attack. The `port_status` variable encodes both current port state and immutable change bits that the USB hub infrastructure treats as ground truth. By corrupting these change bits through the undefined behavior of an out-of-bounds shift, an attacker can confuse downstream hub status logic that relies on those bits to detect device connect, disconnect, and power state changes. What makes this analytically significant is not the CVSS 7.8 score but the EPSS 0.00181. The MAX3421 is a specialized USB On-The-Go and embedded controller—rare in commodity servers but present in embedded systems, development boards, and USB analytics hardware. The /dev/bus/usb access requirement constrains the attacker, though it is not equivalent to full local privilege escalation. More importantly, this driver presents itself as a root hub to the Linux USB stack, meaning corrupted port_status affects the root of trust for device enumeration, driver binding, and power management across the entire bus downstream of this controller. The blast radius is systemic even if the hardware is rare. The detection method matters more than the bug itself. KLEE-based symbolic execution found this vulnerability—meaning traditional fuzzing and code review missed it. This is not an isolated case. Shift-width validation bugs in USB hub control paths have a documented lineage including CVE-2016-10167, CVE-2017-16525, and others. Each was individually labeled low-probability and treated as closed. None triggered the API contract redesign that would prevent the next occurrence. The pattern persists because the USB hub control interface carries assumptions from the USB 2.0 era about `wValue` ranges that were valid when hardware port counts were smaller, and driver authors inherit unchecked switch-case templates without the implicit bounds contracts that made them safe. For prioritization: the real question is not whether this specific bug is likely to be hit, but what downstream code trusts port_status without re-validation. The MAX3421 is a root hub—corruption of its status model affects device identity and enumeration across the entire controlled bus. Even if the hardware is rare, the structural pattern almost certainly exists in other USB host controller drivers. Treat this CVE as a signal of a class of similar bugs rather than an isolated finding, and instrument your driver review process with symbolic execution to find them systematically.

Reviewed through automated stages and approved by a human before publication.