Executive brief
The Linux kernel's USB ATM driver initializes certain configuration fields to invalid values, causing undefined behavior when those fields are used as bit-shift operands. While not immediately exploitable for system compromise, this defect triggers undefined behavior that can lead to unpredictable kernel behavior or crashes when ATM devices interact with the network stack.
Technical details
The vulnerability is an improper initialization of the ci_range.vpi_bits and ci_range.vci_bits fields in usbatm_atm_init(), which are set to ATM_CI_MAX (-1) instead of valid bit counts (8 for vpi_bits and 16 for vci_bits). These fields are subsequently used as bit-shift operands in net/atm/common.c, resulting in undefined behavior when shifting by a negative value. The vulnerability is reachable via socket binding operations on ATM devices without requiring elevated privileges. UBSAN detects this as a shift-out-of-bounds violation. A patch has been applied to the Linux kernel mainline, setting vpi_bits to 8 and vci_bits to 16 in accordance with ATM UNI cell header specifications.
Affected products
- Linux Linux kernel versions containing usbatm driver with improper ci_range initialization
Timeline
- 2026-09-17: disclosed: Advisory published on NVD
- patched: Patch applied to Linux kernel mainline, setting vpi_bits to 8 and vci_bits to 16