CVE-2026-80997 Overview
CVE-2026-80997 is a denial-of-service vulnerability in the Linux kernel's IP Accelerator (IPA) network driver. The flaw causes the modem transmit queue to stall permanently after a runtime power management resume race condition. When ipa_start_xmit() stops the TX queue before calling pm_runtime_get(), the wake work scheduled by ipa_modem_wake_queue_work() can run while the device is still in RPM_RESUMING state. The wake is consumed too early, leaving nothing to restart the queue once power reaches RPM_ACTIVE. Observed on Qualcomm SM7635 (Fairphone 6), the cellular data path goes permanently deaf within hours, affecting both TX and RX traffic.
Critical Impact
A network-reachable condition permanently stalls the cellular modem data path, requiring device intervention to restore connectivity.
Affected Products
- Linux kernel net/ipa driver (IP Accelerator subsystem)
- Qualcomm platforms using the IPA modem driver (observed on SM7635)
- Mobile/embedded Linux devices with cellular modems routed through IPA
Discovery Timeline
- 2026-09-11 - CVE-2026-80997 published to NVD
- 2026-09-13 - Last updated in NVD database
Technical Details for CVE-2026-80997
Vulnerability Analysis
The vulnerability is a race condition [CWE-362] in the Linux kernel IPA driver's interaction with the runtime power management (PM) subsystem. The transmit path unconditionally stops the netdev TX queue before requesting a runtime PM reference. The driver depends on ipa_modem_wake_queue_work(), scheduled from the runtime resume callback, to restart the queue once the device is active.
The wake work is queued from inside the resume callback before the power state transitions to RPM_ACTIVE. It can therefore execute while the device is still RPM_RESUMING. In that window, the wake restarts the queue, a new transmit stops it again, and pm_runtime_get() returns -EINPROGRESS without scheduling any future wake. The deferred_resume mechanism only handles RPM_SUSPENDING transitions, so no additional wake is ever queued.
Once the resume completes, no work is left to unblock the queue. Packets accumulate in the qdisc, the device runtime-suspends, and because the netdev registers no ndo_tx_timeout handler, the watchdog never fires. The stall is permanent until manual intervention.
Root Cause
The root cause is improper ordering between netdev queue-stop operations and runtime PM state transitions. Removal of the STARTED power flag, which previously masked the window by allowing a wake to suppress a subsequent queue stop, exposed the race. A single transmit occurring during an in-flight resume is now sufficient to strand the queue.
Attack Vector
Exploitation requires triggering repeated runtime suspend/resume cycles on the IPA-managed modem while transmitting packets. An accelerated reproducer with autosuspend delay shortened to 5 ms and roughly 20 packets per second of TX traffic caused three stalls in 230 seconds on an unpatched kernel. A remote attacker able to induce sustained low-rate traffic against a target device could trigger the stall, resulting in loss of cellular data connectivity. No authentication or user interaction is required.
No public proof-of-concept exploit code has been released. The fix modifies the wake work to call pm_runtime_get_sync(), ensuring the resume completes before the queue is woken. If the resume fails, the queue is woken anyway so pending packets are dropped rather than stranded.
Detection Methods for CVE-2026-80997
Indicators of Compromise
- Cellular data connectivity loss on affected devices with no recovery until reboot or driver reload.
- Growing qdisc backlog on the IPA modem netdev interface visible via tc -s qdisc show dev <iface>.
- Runtime PM state stuck in suspended for the IPA device while packets remain queued.
- Absence of ndo_tx_timeout watchdog events despite stalled transmit queue.
Detection Strategies
- Monitor per-interface TX drop counters and qdisc backlog depth for sustained non-zero values without corresponding link events.
- Correlate cellular modem endpoint state (/sys/kernel/debug/ipa/) with netdev queue state to identify queue-stopped conditions during PM suspension.
- Track kernel log messages from the IPA subsystem for resume completion events not followed by queue restarts.
Monitoring Recommendations
- Deploy fleet telemetry on mobile Linux devices to report cellular data path health metrics, including RX and TX byte counters over sliding windows.
- Alert on devices reporting zero cellular throughput while the modem link remains registered.
- Aggregate runtime PM statistics from /sys/bus/platform/devices/*/power/runtime_status to detect anomalous suspend patterns.
How to Mitigate CVE-2026-80997
Immediate Actions Required
- Apply the upstream Linux kernel patch series referenced in the commits 30cef9c1229, 30d5226bac5, 3cbfd627ee7, and 62da38b4b3a.
- Inventory devices running Qualcomm platforms with the IPA modem driver and prioritize kernel updates for cellular-connected fleets.
- Verify vendor kernels for Android and embedded Linux distributions include the backported fix.
Patch Information
The fix modifies the wake work to invoke pm_runtime_get_sync(), blocking until the resume completes before restarting the queue. Every queue stop is then guaranteed a later wake that occurs while power is RPM_ACTIVE. See the upstream commits: Linux Kernel Commit 30cef9c1229, Linux Kernel Commit 30d5226bac5, Linux Kernel Commit 3cbfd627ee7, and Linux Kernel Commit 62da38b4b3a. With the patch applied, a 3601-second test transmitted 70298 packets without a stall.
Workarounds
- Increase the IPA runtime PM autosuspend delay to reduce the frequency of suspend/resume cycles that trigger the race.
- Implement watchdog scripts that monitor cellular throughput and reload the IPA driver module or reset the modem endpoint when a stall is detected.
- Where feasible, disable runtime PM on the IPA device as a temporary measure, accepting the increased power consumption.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
