CVE-2026-23446: Linux Kernel aqc111 Driver DoS Vulnerability

CVE-2026-23446 Overview

A deadlock vulnerability has been identified in the Linux kernel's aqc111 USB network driver. The vulnerability occurs when the aqc111_suspend() callback incorrectly performs power management (PM) operations, causing a task hang in rpm_resume(). This flaw was discovered by syzbot, the automated kernel fuzzing infrastructure.

When the suspend callback attempts to use the PM variant of write_cmd routine, it creates a recursive power management call chain that results in the system waiting indefinitely for a status change that will never occur. This subsequently blocks another task holding rtnl_lock, effectively locking up the entire networking stack.

Critical Impact

This vulnerability can cause a complete system hang affecting the networking stack, leading to denial of service conditions on affected Linux systems using Aquantia AQC111 USB network adapters.

Affected Products

• Linux kernel (multiple stable versions) with aqc111 USB network driver
• Systems using Aquantia AQC111 USB 3.0 to 5G Ethernet adapters
• Linux distributions with affected kernel versions

Discovery Timeline

• 2026-04-03 - CVE CVE-2026-23446 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-23446

Vulnerability Analysis

This vulnerability represents a race condition and deadlock issue within the Linux kernel's power management subsystem, specifically in the aqc111 USB network driver. The core problem lies in improper power management operation sequencing during system suspend operations.

When a USB device enters suspend state, the runtime PM status transitions to RPM_SUSPENDING. During this transition, the aqc111_suspend() function is called for the USB device interface. The problematic call chain occurs when this function invokes aqc111_write32_cmd(), which internally calls usb_autopm_get_interface().

This triggers pm_runtime_resume_and_get(), which then calls rpm_resume() on the parent device. However, since the parent is already in the suspending state, the system enters a blocking wait for a status change that cannot occur—creating an indefinite deadlock.

Root Cause

The root cause is the incorrect use of PM-aware write command functions within the suspend callback context. The aqc111_suspend() function calls aqc111_write32_cmd() which uses usb_autopm_get_interface(). When the device is already in the process of suspending (RPM_SUSPENDING state), attempting to resume power management creates a circular dependency.

The simplified problematic call trace is:

1. rpm_suspend() → usb_suspend_both() (sets runtime_status = RPM_SUSPENDING)
2. aqc111_suspend() → aqc111_write32_cmd()
3. usb_autopm_get_interface() → pm_runtime_resume_and_get()
4. rpm_resume() on parent → blocked indefinitely

Attack Vector

The vulnerability can be triggered through normal system power management operations such as:

• System suspend/hibernate operations
• USB selective suspend (autosuspend)
• Runtime power management events

While this is primarily a local denial of service vulnerability, it requires no special privileges to trigger—any action that causes the AQC111 USB network device to enter suspend state can potentially trigger the deadlock. Once triggered, the system's networking stack becomes completely unresponsive as another task holding rtnl_lock is blocked.

The fix involves replacing the power management-aware write_cmd calls with their _nopm (no power management) variants within the suspend callback, ensuring no recursive PM operations occur during the suspend sequence.

Detection Methods for CVE-2026-23446

Indicators of Compromise

• System logs showing "task hung in rpm_resume" messages from syzbot or kernel
• Kernel stack traces indicating deadlock in aqc111_suspend() or related PM functions
• Network stack becoming completely unresponsive during suspend operations
• Processes blocking on rtnl_lock acquisition with indefinite wait times

Detection Strategies

• Monitor kernel logs for hung task warnings related to runtime PM or USB suspend operations
• Implement kernel function tracing on rpm_suspend(), rpm_resume(), and aqc111_suspend() to identify abnormal call patterns
• Use kernel lockdep debugging to detect potential deadlock scenarios in USB network drivers
• Monitor for system hangs coinciding with USB device power state transitions

Monitoring Recommendations

• Enable kernel hang detection mechanisms and configure appropriate timeout thresholds
• Set up automated alerting for kernel messages containing "task hung" or "rtnl_lock" related warnings
• Monitor system suspend/resume operations for unusual delays or failures on systems with AQC111 adapters
• Implement watchdog timers to detect and recover from system-wide networking stack deadlocks

How to Mitigate CVE-2026-23446

Immediate Actions Required

• Update the Linux kernel to a patched version containing the fix for the aqc111 driver
• If immediate patching is not possible, consider disabling USB autosuspend for AQC111 devices as a temporary workaround
• Monitor systems with AQC111 USB network adapters for signs of hanging during power management operations
• Review and test system suspend/resume functionality after applying patches

Patch Information

Multiple kernel commits have been released to address this vulnerability across stable kernel branches:

• Kernel Commit 069c8f5
• Kernel Commit 3267bcb
• Kernel Commit 4de6a43
• Kernel Commit 621f2f4
• Kernel Commit 98e8aed
• Kernel Commit d3e32a6

The fix replaces the PM-aware write_cmd calls with their _nopm variants in the suspend callback path.

Workarounds

• Disable USB autosuspend for AQC111 devices by setting power management control to "on"
• Unload the aqc111 driver module if the USB network adapter is not required
• Use alternative network interfaces during system power management operations
• Configure systems to skip suspend for USB ethernet adapters using udev rules

# Disable USB autosuspend for AQC111 devices
echo "on" > /sys/bus/usb/devices/<device-id>/power/control

# Alternative: Create a udev rule to disable autosuspend
# /etc/udev/rules.d/99-aqc111-no-autosuspend.rules
# ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="2eca", ATTR{power/control}="on"