Linux CVE-2026-23446

The aqc111 driver manages Aquantia USB network adapters within the Linux kernel's USB subsystem. The vulnerability stems from improper power management (PM) sequencing during the suspend callback. When usb_suspend_both() invokes the driver's suspend handler while the USB device's power.runtime_status is RPM_SUSPENDING, the driver incorrectly calls aqc111_write32_cmd(), which internally invokes usb_autopm_get_interface() to acquire PM rights. This function calls pm_runtime_resume_and_get() on the parent device, triggering rpm_resume() recursively. The second rpm_resume() call attempts to wait for the parent device's status to change from RPM_SUSPENDING, but since the parent is already suspended and the child holds rtnl_lock, the wait never completes-creating a classic deadlock. The CWE root cause is improper locking/synchronization during nested power management state transitions (CWE-667: Improper Locking). The fix replaces PM-aware write commands with non-PM variants (_nopm suffix) that do not attempt to acquire additional power references during suspend.