The vulnerability exists in the Linux kernel’s USB host driver for Max3421 devices. In the function that processes hub class requests, the code left‑shifts a constant 1 by the value supplied in a control request without validating that the shift amount fits within the width of the destination word. If a userspace process with access to the virtual root hub issues a USBDEVFS_CONTROL ioctl with wValue of 32 or greater, the shift operation triggers undefined behavior, corrupting bits in the hub’s status register. This corruption can bypass internal state checks and alter message handling, potentially causing the driver to lose track of connected devices and leading to a denial of service or incorrect device reporting. The impact is therefore a loss of reliable USB hub functionality, which can disrupt system operation.

The flaw affects all Linux kernel builds that include the max3421 USB host controller driver, specifically systems running newer kernels where the driver module is compiled. No version range is provided in the CNA data, so any kernel containing this code path is potentially vulnerable, including current stable releases that have not yet applied the patch.

The CVSS score of 7.8 indicates a high severity vulnerability. The undefined shift operation and ability for a userspace attacker to issue arbitrary control requests make exploitation likely for local users with access to the USB devices. The EPSS score of < 1% (0.00181) indicates a low but non‑zero probability of exploitation and the vulnerability is not listed in the CISA KEV catalog. Because the flaw can be triggered without additional privileges, it poses a significant risk in multi‑user or shared environments.