In the Linux kernel, the following vulnerability has been resolved:
net: usb: aqc111: Do not perform PM inside suspend callback
syzbot reports "task hung in rpm_resume"
This is caused by aqc111_suspend calling
the PM variant of its write_cmd routine.
The simplified call trace looks like this:
rpm_suspend()
usb_suspend_both() - here udev->dev.power.runtime_status == RPM_SUSPENDING
aqc111_suspend() - called for the usb device interface
aqc111_write32_cmd()
usb_autopm_get_interface()
pm_runtime_resume_and_get()
rpm_resume() - here we call rpm_resume() on our parent
rpm_resume() - Here we wait for a status change that will never happen.
At this point we block another task which holds
rtnl_lock and locks up the whole networking stack.
Fix this by replacing the write_cmd calls with their _nopm variants
References
Configurations
Configuration 1 (hide)
|
History
23 Apr 2026, 20:57
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/069c8f5aebe4d5224cf62acc7d4b3486091c658a - Patch | |
| References | () https://git.kernel.org/stable/c/3267bcb744ee8a2feabaa7ab69473f086f67fd71 - Patch | |
| References | () https://git.kernel.org/stable/c/4de6a43e8ecf961feabddf0e9d6911081d2ed218 - Patch | |
| References | () https://git.kernel.org/stable/c/621f2f43741b51f62d767eb4752fbcefe2526926 - Patch | |
| References | () https://git.kernel.org/stable/c/98e8aed64614b0c199d5f0391fbe1a4331cb5773 - Patch | |
| References | () https://git.kernel.org/stable/c/b87f361d41f9a7f1f6c426947ca815651c481376 - Patch | |
| References | () https://git.kernel.org/stable/c/cc06ac99fd78839b2d38850785731ef131d9ae26 - Patch | |
| References | () https://git.kernel.org/stable/c/d3e32a612c6391ca9b7c183aeec22b4fd24c300c - Patch | |
| CWE | NVD-CWE-noinfo | |
| First Time |
Linux
Linux linux Kernel |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| CPE | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.0:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* |
18 Apr 2026, 09:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
03 Apr 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-03 16:16
Updated : 2026-04-23 20:57
NVD link : CVE-2026-23446
Mitre link : CVE-2026-23446
CVE.ORG link : CVE-2026-23446
JSON object : View
Products Affected
linux
- linux_kernel
CWE