CVE-2025-40120

In the Linux kernel's AX88772(A/B) USB Ethernet driver (asix), the usbnet infrastructure enables USB runtime PM (autosuspend) by default. The driver's flag to disable autosuspend is ineffective, so the device may spontaneously suspend during operation. This creates a risk when ndo_open() (called under RTNL) triggers an autoresume into asix_resume() while the USB PM lock is held, leading to a deadlock as phylink/phylib and MDIO operations in the resume path also expect RTNL. [1]

To exploit this bug, an attacker would need to influence the timing of a network interface open (admin up) or rely on autosuspend occurring naturally. No special privileges beyond the ability to manage network interfaces are required, but on many systems the vulnerability can be triggered during normal operation without deliberate action. The core issue is that the PM usage count is not incremented during ax88772_bind(), allowing runtime suspend to proceed. [2]

The deadlock can cause the system to hang, resulting in a denial of service. In environments where the network interface is critical, this could lead to persistent service disruption until a reboot. No remote code execution or data leakage is expected from this vulnerability alone; it is a lock-ordering problem confined to kernel synchronization primitives. [1][2]

The fix, already applied to the Linux kernel stable branches, increments the PM usage reference in ax88772_bind() and drops it in unbind(), preventing runtime suspend regardless of sysfs settings. System-wide (suspend-to-RAM) sleep is unaffected. Users should update their kernel to include commit 71a0ba7fdaf8 or equivalent backport. [1][2]