CVE-2026-23446 — Deadlock in Linux
Severity
6.9MEDIUM
No vectorEPSS
0.0%
top 90.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 3
Description
In the Linux kernel, the following vulnerability has been resolved:
net: usb: aqc111: Do not perform PM inside suspend callback
syzbot reports "task hung in rpm_resume"
This is caused by aqc111_suspend calling
the PM variant of its write_cmd routine.
The simplified call trace looks like this:
rpm_suspend()
usb_suspend_both() - here udev->dev.power.runtime_status == RPM_SUSPENDING
aqc111_suspend() - called for the usb device interface
aqc111_write32_cmd()
usb_autopm_get_interface()
pm_runtim…
Affected Packages3 packages
▶CVEListV5linux/linuxe58ba4544c7771591d1e3157bc01b4a8e4d1c3fc — 621f2f43741b51f62d767eb4752fbcefe2526926+6
🔴Vulnerability Details
2OSV▶
CVE-2026-23446: In the Linux kernel, the following vulnerability has been resolved: net: usb: aqc111: Do not perform PM inside suspend callback syzbot reports "task h↗2026-04-03
GHSA▶
GHSA-mqjm-rhm6-4854: In the Linux kernel, the following vulnerability has been resolved:
net: usb: aqc111: Do not perform PM inside suspend callback
syzbot reports "task↗2026-04-03