CVE-2026-23188: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23188 is a deadlock vulnerability in the Linux kernel's r8152 (rtl8152) USB network driver, classified under CWE-667 (Improper Locking). The flaw causes a system denial of service during suspend/resume cycles when the driver triggers a device reset while holding the tp->control mutex, leading to a recursive mutex lock deadlock, a kernel panic after 15 seconds, and a DPM timeout after 10 seconds. Affected Linux kernel versions include 6.11 through 6.12.69, 6.13 through 6.18.9, and 6.19-rc1 through 6.19-rc8. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is improper locking (CWE-667) in the rtl8152_resume() function of the Linux kernel's net/usb/r8152 driver. During resume, the driver calls usb_reset_device() while holding the tp->control mutex; the reset path re-enters the driver via rtl8152_post_reset() → dev_set_mac_address() → __rtl8152_set_mac_address(), which attempts to acquire the same tp->control mutex again, causing a recursive deadlock. The fix moves the reset of INACCESSIBLE devices outside the tp->control mutex scope to prevent recursive locking. Exploitation requires local access and low privileges — an attacker or unprivileged user must be able to trigger a suspend/resume cycle on a system with an RTL8152-based USB network adapter (Feedly, git.kernel.org).

Successful exploitation results in a complete denial of service: the system's Device Power Management (DPM) subsystem times out after 10 seconds and triggers a kernel panic after 15 seconds, rendering the affected system unusable until a reboot. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Any system using RTL8152-based USB network adapters (a common USB-to-Ethernet chipset) that undergoes suspend/resume cycles is at risk (Feedly).

Apply the patched Linux kernel versions: 6.12.70 or later (for 6.11–6.12.x series), 6.18.10 or later (for 6.13–6.18.x series), or any stable 6.19 release. Patches are available at git.kernel.org with commits 1b2efc593dca, 61c8091b7937, and 6d06bc83a5ae. As a temporary workaround where patching is not immediately feasible, administrators should avoid suspend/resume cycles on systems with RTL8152 USB network adapters, or disable power management features for the affected USB device. Debian and Oracle Linux have also issued distribution-specific kernel updates addressing this vulnerability (Feedly, git.kernel.org).

Debian issued a security advisory (DSA-6141-1) and Oracle Linux released advisories (ELSA-2026-50160 and ELSA-2026-50232) addressing this vulnerability as part of broader kernel update packages. Tenable's Nessus scanner added detection plugins (IDs 299119 and 303468) for this CVE. No notable independent researcher commentary or significant social media discussion has been observed (Feedly).