CVE-2026-23446: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23446 is a deadlock vulnerability in the Linux kernel's net/usb/aqc111 USB network driver that can cause a complete denial of service by locking up the entire networking stack. The flaw was published on April 3, 2026, and affects Linux kernel versions from 5.0.1 through 6.19.9 across multiple stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium), requiring only local access with low privileges to trigger (GitHub Advisory, Feedly).

The root cause is an improper synchronization (CWE-667 / deadlock) in the aqc111_suspend() callback, which incorrectly calls the Power Management (PM) variant of its write_cmd routine (aqc111_write32_cmd) during device suspension. This triggers a nested PM runtime resume call chain: rpm_suspend() → usb_suspend_both() → aqc111_suspend() → usb_autopm_get_interface() → pm_runtime_resume_and_get() → rpm_resume(), which then waits indefinitely for a runtime status change that will never occur because the device is already in RPM_SUSPENDING state. The blocked task holds rtnl_lock, freezing the entire networking subsystem. The fix replaces all write_cmd calls within the suspend path with their _nopm (no power management) variants (GitHub Advisory).

Successful exploitation causes a complete denial of service of the networking stack on the affected system. Because the deadlock acquires rtnl_lock — a critical kernel lock used broadly across the networking subsystem — all network interfaces become unavailable until the system is rebooted. There is no confidentiality or integrity impact; the vulnerability is purely an availability issue affecting any system using the AQC111 USB network adapter (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term. Triggering the bug requires local access and the ability to initiate USB device suspension on a system with an AQC111 adapter (Feedly, GitHub Advisory).

• Logs: Kernel log messages containing "task hung in rpm_resume" or similar hung-task warnings related to the aqc111 driver; rtnl_lock contention warnings in dmesg or /var/log/kern.log.
• Process/System Behavior: Complete loss of network connectivity on systems using AQC111 USB network adapters following a USB suspend event; system unresponsive to network commands (ip, ifconfig) without returning errors.
• Kernel State: Kernel stack traces showing threads blocked in rpm_resume() waiting on a status change, visible via sysrq-t or crash dump analysis.

Apply the patched kernel versions released by the Linux kernel stable team: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, or 7.0-rc5 and later. Distribution-specific updates have been issued by SUSE (SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1), Debian, and openSUSE. As a temporary workaround, disabling runtime power management for AQC111 USB devices (e.g., via udev rules or echo 'on' > /sys/bus/usb/devices/<device>/power/control) can prevent the suspend path from being triggered until a patch is applied (GitHub Advisory, SUSE Advisory).

The vulnerability was reported by syzbot, Google's automated kernel fuzzing infrastructure, which identified the "task hung in rpm_resume" condition. Distribution vendors including SUSE, Debian, and the Yocto Project have issued security advisories and updated packages. No notable independent researcher commentary or significant social media discussion has been observed beyond routine patch tracking (SUSE Advisory, Yocto Security).