CVE-2026-80997

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: ipa: fix stalled modem TX queue after runtime resume

ipa_start_xmit() unconditionally stops the TX queue before calling

pm_runtime_get(), relying on the wake scheduled by runtime resume

(ipa_modem_wake_queue_work()) to restart it once power is ACTIVE.

But that work is queued from within the runtime resume callback,

before the device's power state reaches RPM_ACTIVE, so it can run

while the device is still RPM_RESUMING. The wake is then consumed

too early: the transmit it restarts stops the queue again,

pm_runtime_get() returns -EINPROGRESS without arranging any future

wake (deferred_resume exists only for RPM_SUSPENDING), and after the

resume completes nothing is left to wake the queue. Transmit stalls

permanently: packets pile up in the qdisc behind the stopped queue,

the device runtime-suspends, and since the netdev registers no

ndo_tx_timeout the watchdog never fires. Observed on SM7635

(Fairphone 6) as th

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References