CVE-2026-23446: Linux Kernel aqc111 Driver DoS Vulnerability

CVE-2026-23446 Overview

A deadlock vulnerability has been identified in the Linux kernel's aqc111 USB network driver. The vulnerability occurs when the aqc111_suspend() callback incorrectly performs power management (PM) operations, causing a task hang in rpm_resume(). This flaw was discovered by syzbot, the automated kernel fuzzing infrastructure.

When the suspend callback attempts to use the PM variant of write_cmd routine, it creates a recursive power management call chain that results in the system waiting indefinitely for a status change that will never occur. This subsequently blocks another task holding rtnl_lock, effectively locking up the entire networking stack.

Critical Impact
This vulnerability can cause a complete system hang affecting the networking stack, leading to denial of service conditions on affected Linux systems using Aquantia AQC111 USB network adapters.

Affected Products

Linux kernel (multiple stable versions) with aqc111 USB network driver
Systems using Aquantia AQC111 USB 3.0 to 5G Ethernet adapters
Linux distributions with affected kernel versions

Discovery Timeline

2026-04-03 - CVE CVE-2026-23446 published to NVD
2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-23446

Vulnerability Analysis

This vulnerability represents a race condition and deadlock issue within the Linux kernel's power management subsystem, specifically in the aqc111 USB network driver. The core problem lies in improper power management operation sequencing during system suspend operations.

When a USB device enters suspend state, the runtime PM status transitions to RPM_SUSPENDING. During this transition, the aqc111_suspend() function is called for the USB device interface. The problematic call chain occurs when this function invokes aqc111_write32_cmd(), which internally calls usb_autopm_get_interface().

This triggers pm_runtime_resume_and_get(), which then calls rpm_resume() on the parent device. However, since the parent is already in the suspending state, the system enters a blocking wait for a status change that cannot occur—creating an indefinite deadlock.

Root Cause

The root cause is the incorrect use of PM-aware write command functions within the suspend callback context. The aqc111_suspend() function calls aqc111_write32_cmd() which uses usb_autopm_get_interface(). When the device is already in the process of suspending (RPM_SUSPENDING state), attempting to resume power management creates a circular dependency.

The simplified problematic call trace is:

rpm_suspend() → usb_suspend_both() (sets runtime_status = RPM_SUSPENDING)
aqc111_suspend() → aqc111_write32_cmd()
usb_autopm_get_interface() → pm_runtime_resume_and_get()
rpm_resume() on parent → blocked indefinitely

Attack Vector

The vulnerability can be triggered through normal system power management operations such as:

System suspend/hibernate operations
USB selective suspend (autosuspend)
Runtime power management events

While this is primarily a local denial of service vulnerability, it requires no special privileges to trigger—any action that causes the AQC111 USB network device to enter suspend state can potentially trigger the deadlock. Once triggered, the system's networking stack becomes completely unresponsive as another task holding rtnl_lock is blocked.

The fix involves replacing the power management-aware write_cmd calls with their _nopm (no power management) variants within the suspend callback, ensuring no recursive PM operations occur during the suspend sequence.

Detection Methods for CVE-2026-23446

Indicators of Compromise

System logs showing "task hung in rpm_resume" messages from syzbot or kernel
Kernel stack traces indicating deadlock in aqc111_suspend() or related PM functions
Network stack becoming completely unresponsive during suspend operations
Processes blocking on rtnl_lock acquisition with indefinite wait times

Detection Strategies

Monitor kernel logs for hung task warnings related to runtime PM or USB suspend operations
Implement kernel function tracing on rpm_suspend(), rpm_resume(), and aqc111_suspend() to identify abnormal call patterns
Use kernel lockdep debugging to detect potential deadlock scenarios in USB network drivers
Monitor for system hangs coinciding with USB device power state transitions

Monitoring Recommendations

Enable kernel hang detection mechanisms and configure appropriate timeout thresholds
Set up automated alerting for kernel messages containing "task hung" or "rtnl_lock" related warnings
Monitor system suspend/resume operations for unusual delays or failures on systems with AQC111 adapters
Implement watchdog timers to detect and recover from system-wide networking stack deadlocks

How to Mitigate CVE-2026-23446

Immediate Actions Required

Update the Linux kernel to a patched version containing the fix for the aqc111 driver
If immediate patching is not possible, consider disabling USB autosuspend for AQC111 devices as a temporary workaround
Monitor systems with AQC111 USB network adapters for signs of hanging during power management operations
Review and test system suspend/resume functionality after applying patches

Patch Information

Multiple kernel commits have been released to address this vulnerability across stable kernel branches:

The fix replaces the PM-aware write_cmd calls with their _nopm variants in the suspend callback path.

Workarounds

Disable USB autosuspend for AQC111 devices by setting power management control to "on"
Unload the aqc111 driver module if the USB network adapter is not required
Use alternative network interfaces during system power management operations
Configure systems to skip suspend for USB ethernet adapters using udev rules

bash

# Disable USB autosuspend for AQC111 devices
echo "on" > /sys/bus/usb/devices/<device-id>/power/control

# Alternative: Create a udev rule to disable autosuspend
# /etc/udev/rules.d/99-aqc111-no-autosuspend.rules
# ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="2eca", ATTR{power/control}="on"