CVE-2026-23188: net: usb: r8152: fix resume reset deadlock
In the Linux kernel, the following vulnerability has been resolved:
net: usb: r8152: fix resume reset deadlock
rtl8152 can trigger device reset during reset which potentially can result in a deadlock:
DPM device timeout after 10 seconds; 15 seconds until panic Call Trace: <TASK> schedule+0x483/0x1370 schedulepreemptdisabled+0x15/0x30 mutexlockcommon+0x1fd/0x470 rtl8152setmacaddress+0x80/0x1f0 devsetmacaddress+0x7f/0x150 rtl8152postreset+0x72/0x150 usbresetdevice+0x1d0/0x220 rtl8152resume+0x99/0xc0 usbresumeinterface+0x3e/0xc0 usbresumeboth+0x104/0x150 usbresume+0x22/0x110
The problem is that rtl8152 resume calls reset under tp->control mutex while reset basically re-enters rtl8152 and attempts to acquire the same tp->control lock once again.
Reset INACCESSIBLE device outside of tp->control mutex scope to avoid recursive mutexlock() deadlock.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23188?
CVE-2026-23188 is considered a moderate severity vulnerability due to potential device deadlock issues during reset.
How do I fix CVE-2026-23188?
To fix CVE-2026-23188, you should update your Linux kernel to the latest version where the vulnerability has been patched.
What systems are affected by CVE-2026-23188?
CVE-2026-23188 affects systems using the rtl8152 USB network drivers in the Linux kernel.
What problems can CVE-2026-23188 cause?
CVE-2026-23188 can lead to device timeout and potential deadlock during the reset process of network devices.
Is there a workaround for CVE-2026-23188?
Currently, there are no known workarounds for CVE-2026-23188; updating the kernel is the recommended action.