A flaw in the Linux kernel’s aqc111 USB driver performs a power‑management operation during device suspend that leads to a deadlock. The driver’s suspend routine invokes a write command that internally calls a runtime power‑management function. This causes the kernel to block waiting for a status change that never occurs, locking the networking stack and ultimately freezing the system. The impact is a denial of availability for the entire host because the kernel cannot recover without a reboot.

The vulnerability exists in any Linux kernel build that contains the aqc111 driver prior to the upstream patch that replaces the write command with its _nopm variant. No specific affected‑version list is provided, so all kernels that ship the obsolete driver code may be vulnerable.

No CVSS score is supplied and EPSS information is unavailable; the weakness is not listed in the CISA KEV catalog, indicating that it has not been reported as widely exploited yet. Exploitation requires a local or privileged user who can trigger a USB suspend cycle on a device that uses the aqc111 driver—plugging or unplugging such a device can reproduce the hang. The attack vector is therefore inferred to be local with the precondition that the driver is active on the target system.