Junglewise Threat Intelligence

CVE-2026-23446: Linux Kernel deadlock in aqc111 USB Ethernet driver

CVE-2026-23446 · Severity: medium · CVSS 5.5 · Published 2026-04-03

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability in the Linux kernel's Aquantia AQC111 USB Ethernet driver can cause the entire system networking stack to lock up. This occurs when the system attempts to enter a power-saving suspend mode, leading to a permanent 'hang' or freeze of networking tasks. For businesses, this could result in a complete loss of network connectivity and service availability on affected devices, including certain industrial Siemens controllers.

Technical details

A deadlock (task hung) vulnerability exists in the aqc111 USB Ethernet driver within the Linux kernel. The issue is caused by the 'aqc111_suspend' callback incorrectly invoking power-management (PM) aware versions of command routines (like aqc111_write32_cmd) while the device is already in the process of suspending. This triggers a recursive call to 'rpm_resume' that waits indefinitely for a status change, subsequently blocking the 'rtnl_lock'. An attacker with local access could potentially trigger this condition to cause a permanent Denial of Service (DoS) of the networking stack. The fix involves replacing these calls with '_nopm' variants that do not attempt runtime power management during the suspend cycle.

Affected products

  • Linux Linux Kernel versions prior to 2026-03-17 fixes
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-13: disclosed: Vulnerability reported by syzbot
  • 2026-03-17: patched: Initial patch committed to Linux mainline
  • 2026-04-03: advisory: CVE published

References

Related threats