The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() The `max3421_hub_control()` function     handles USB hub class requests to the virtual root hub. In the `default` branches of both the     `ClearPortFeature` and `SetPortFeature` switch statements, it modifies `max3421_hcd->port_status` by left     shifting 1 by the request's `value` parameter. However, it does not validate whether this shift will     exceed the width of `port_status`. So if a malicious userspace task with access to the root hub via     /dev/bus/usb/.../001 issues a USBDEVFS_CONTROL ioctl with `wValue` greater than or equal to 32, the left     shift operation invokes shift-out-of-bounds undefined behavior. This results in arbitrary bit corruption     of `port_status`, including the normally-immutable change bits, which can bypass internal state checks and     confuse the hub status. Fix this by rejecting requests whose `value` exceeds the shift width before     performing the shift. This issue was found using a KLEE-based symbolic execution tool for kernel drivers     that I'm currently developing. (CVE-2026-72483)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104552 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()

    The `max3421_hub_control()` function handles USB hub class requests     to the virtual root hub. In the `default` branches of both the     `ClearPortFeature` and `SetPortFeature` switch statements, it modifies     `max3421_hcd->port_status` by left shifting 1 by the request's `value`     parameter. However, it does not validate whether this shift will exceed     the width of `port_status`.

    So if a malicious userspace task with access to the root hub via     /dev/bus/usb/.../001 issues a USBDEVFS_CONTROL ioctl with `wValue`     greater than or equal to 32, the left shift operation invokes     shift-out-of-bounds undefined behavior. This results in arbitrary     bit corruption of `port_status`, including the normally-immutable     change bits, which can bypass internal state checks and confuse the     hub status.

    Fix this by rejecting requests whose `value` exceeds the shift width     before performing the shift.

    This issue was found using a KLEE-based symbolic execution tool for     kernel drivers that I'm currently developing.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
337431	Linux Distros Unpatched Vulnerability : CVE-2026-72483	Nessus	Misc.	8/18/2026	8/28/2026	high
334784	Photon OS 5.0: Linux PHSA-2026-5.0-92-0952	Nessus	PhotonOS Local Security Checks	8/12/2026	9/7/2026	high
339602	Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104552)	Nessus	Unity Linux Local Security Checks	8/26/2026	8/26/2026	high

Detections

Analytics

Plugins Search

high

high

high