Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-23446

net: usb: aqc111: Do not perform PM inside suspend callback

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, and 2 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: net: usb: aqc111: Do not perform PM inside suspend callback syzbot reports "task hung in rpm_resume" This is caused by aqc111_suspend calling the PM variant of its write_cmd routine. The simplified call trace looks like this: rpm_suspend() usb_suspend_both() - here udev->dev.power.runtime_status == RPM_SUSPENDING aqc111_suspend() - called for the usb device interface aqc111_write32_cmd() usb_autopm_get_interface() pm_runtime_resume_and_get() rpm_resume() - here we call rpm_resume() on our parent rpm_resume() - Here we wait for a status change that will never happen. At this point we block another task which holds rtnl_lock and locks up the whole networking stack. Fix this by replacing the write_cmd calls with their _nopm variants

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From e58ba4544c7771591d1e3157bc01b4a8e4d1c3fc · fixed in cc06ac99fd78839b2d38850785731ef131d9ae26; From e58ba4544c7771591d1e3157bc01b4a8e4d1c3fc · fixed in b87f361d41f9a7f1f6c426947ca815651c481376; From e58ba4544c7771591d1e3157bc01b4a8e4d1c3fc · fixed in 621f2f43741b51f62d767eb4752fbcefe2526926; From e58ba4544c7771591d1e3157bc01b4a8e4d1c3fc · fixed in 4de6a43e8ecf961feabddf0e9d6911081d2ed218; From e58ba4544c7771591d1e3157bc01b4a8e4d1c3fc · fixed in 3267bcb744ee8a2feabaa7ab69473f086f67fd71; From e58ba4544c7771591d1e3157bc01b4a8e4d1c3fc · fixed in d3e32a612c6391ca9b7c183aeec22b4fd24c300c; From e58ba4544c7771591d1e3157bc01b4a8e4d1c3fc · fixed in 98e8aed64614b0c199d5f0391fbe1a4331cb5773; From e58ba4544c7771591d1e3157bc01b4a8e4d1c3fc · fixed in 069c8f5aebe4d5224cf62acc7d4b3486091c658a

  • Linux Linux

    5.0

  • KernelLinux

    From 5.0.0 · fixed in 5.10.253; From 5.11.0 · fixed in 5.15.203; From 5.16.0 · fixed in 6.1.167; From 6.2.0 · fixed in 6.6.130; From 6.7.0 · fixed in 6.12.78; From 6.13.0 · fixed in 6.18.20; From 6.19.0 · fixed in 6.19.10

References 8

git.kernel.org