CVE-2026-90055: usb: atm: usbatm: fix invalid ci_range initialization
In the Linux kernel, the following vulnerability has been resolved:
usb: atm: usbatm: fix invalid cirange initialization
syzbot reported a shift-out-of-bounds in vccconnect():
UBSAN: shift-out-of-bounds in net/atm/common.c:382:32 shift exponent -1 is negative CPU: 0 UID: 0 PID: 5987 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 Call Trace: <TASK> dumpstacklvl+0xe8/0x150 lib/dumpstack.c:120 ubsanepilogue+0xa/0x30 lib/ubsan.c:233 ubsanhandleshiftoutofbounds+0x36d/0x400 lib/ubsan.c:494 vccconnect+0x14b4/0x19c0 net/atm/common.c:382 vccconnect+0x328/0x8f0 net/atm/common.c:498 pvcbind+0x272/0x380 net/atm/pvc.c:52 sysbind+0x2e3/0x410 net/socket.c:1976 x64sysbind+0x7a/0x90 net/socket.c:1979 ...
ATM device cirange fields (vpibits and vcibits) represent the number of bits supported for VPI and VCI addressing on the device. net/atm/common.c directly uses these fields as bit shift counts: vpi >> dev->cirange.vpibits vci >> dev->cirange.vcibits 1 << vcc->dev->cirange.vpibits 1 << vcc->dev->cirange.vcibits
usbatmatminit() sets cirange.vpibits and cirange.vcibits to ATMCIMAX (-1), which is defined in <uapi/linux/atmdev.h> as a sentinel value for userspace ATMSETCIRANGE requests, not a valid bit count. Shifting by -1 is undefined behavior and triggers UBSAN warnings.
ATM UNI cell headers allow up to 8 bits for VPI (0..255) and 16 bits for VCI (0..65535). Initialize vpibits to 8 and vcibits to 16, as done by solos-pci.
Affected Software
Event History
Frequently Asked Questions
Which systems are relevant to this issue?
The affected path involves the Linux USB ATM driver (usbatm) and the kernel ATM networking subsystem. Systems not using this driver or ATM path are not identified as affected by the provided information.
What evidence would indicate that this issue has been triggered?
A UBSAN shift-out-of-bounds report in net/atm/common.c:382 during __vcc_connect() is the described symptom. The supplied trace shows the path through vcc_connect(), pvc_bind(), and the bind system call.
Where does the invalid state originate and where is it consumed?
The USB ATM initialization path, usbatm_atm_init(), sets the ATM device ci_range fields. ATM common code later uses the vpi_bits and vci_bits fields as shift counts during connection handling.