CVE-2026-72483: usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()

In the Linux kernel, the following vulnerability has been resolved:

usb: host: max3421: Fix shift-out-of-bounds in max3421hubcontrol()

The max3421hubcontrol() function handles USB hub class requests to the virtual root hub. In the default branches of both the ClearPortFeature and SetPortFeature switch statements, it modifies max3421hcd->portstatus by left shifting 1 by the request's value parameter. However, it does not validate whether this shift will exceed the width of portstatus.

So if a malicious userspace task with access to the root hub via /dev/bus/usb/.../001 issues a USBDEVFSCONTROL ioctl with wValue greater than or equal to 32, the left shift operation invokes shift-out-of-bounds undefined behavior. This results in arbitrary bit corruption of portstatus, including the normally-immutable change bits, which can bypass internal state checks and confuse the hub status.

Fix this by rejecting requests whose value exceeds the shift width before performing the shift.

This issue was found using a KLEE-based symbolic execution tool for kernel drivers that I'm currently developing.