CVE-2026-23446: net: usb: aqc111: Do not perform PM inside suspend callback
In the Linux kernel, the following vulnerability has been resolved:
net: usb: aqc111: Do not perform PM inside suspend callback
syzbot reports "task hung in rpmresume"
This is caused by aqc111suspend calling the PM variant of its writecmd routine.
The simplified call trace looks like this:
rpmsuspend() usbsuspendboth() - here udev->dev.power.runtimestatus == RPMSUSPENDING aqc111suspend() - called for the usb device interface aqc111write32cmd() usbautopmgetinterface() pmruntimeresumeandget() rpmresume() - here we call rpmresume() on our parent rpmresume() - Here we wait for a status change that will never happen.
At this point we block another task which holds rtnllock and locks up the whole networking stack.
Fix this by replacing the writecmd calls with their nopm variants
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the aqc111 PM hang by replacing write_cmd calls with their _nopm variants in aqc111_write32_cmd / aqc111 PM-related paths so PM is not performed inside the suspend callback (the issue described as aqc111_suspend calling aqc111_write32_cmd leading to task hung in rpm_resume).
Linux kernel (net: usb: aqc111) Replace write_cmd calls with their _nopm variants = Use *_nopm* write_cmd variants in place of write_cmd calls (PM variant of write_cmd routine)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23446?
The severity of CVE-2026-23446 is rated as medium with a CVSS score of 5.5.
How do I fix CVE-2026-23446?
To mitigate CVE-2026-23446, ensure your Linux kernel is updated to a version where this vulnerability has been resolved.
What systems are affected by CVE-2026-23446?
CVE-2026-23446 affects the Linux kernel, specifically systems using the aqc111 USB driver.
What is the impact of CVE-2026-23446?
The impact of CVE-2026-23446 is a potential hang in the system operation due to improper power management calls.
Is CVE-2026-23446 being actively exploited?
As of now, there is no public evidence that CVE-2026-23446 is being actively exploited in the wild.