CVE-2026-23446

Vulnerability

CVE-2026-23446 is a deadlock vulnerability in the Linux kernel's aqc111 USB Ethernet driver. The root cause is that the aqc111_suspend callback calls PM (Power Management) variants of its write command routines (e.g., aqc111_write32_cmd), which internally invoke usb_autopm_get_interface and pm_runtime_resume_and_get. During system suspend, the USB device's runtime status is already RPM_SUSPENDING, so calling rpm_resume on the parent device leads to an unresolvable wait, causing a task hang [1].

Exploitation

An attacker with physical access to the USB port or the ability to trigger a system suspend on a machine with an attached AQC111-based USB Ethernet adapter can exploit this. No authentication is required beyond the ability to initiate a suspend cycle. The deadlock occurs during normal suspend operations, making it a reliable denial-of-service vector [1].

Impact

Successful exploitation results in a kernel-level task hang in rpm_resume. This blocks another task holding the `rtnl_lock, effectively locking up the entire networking stack. The system becomes unresponsive for network operations, leading to a denial of service (DoS). The CVSS v3 base score is 5.5 (Medium), reflecting the local attack vector and high availability impact [1].

Mitigation

The fix replaces the PM-aware write command calls with their _nopm variants, preventing the recursive PM operations during suspend. Patches have been applied to the Linux kernel stable branches; users should update to a kernel containing the fix (e.g., commits referenced in [1], [2], [3], [4]). No workaround is available other than applying the patch or avoiding suspend while the device is connected.