CVE-2026-80997

A low-impact race condition was found in the Linux kernel's IP Accelerator (IPA) network driver used with Qualcomm modem hardware. When a local process transmits packets while the IPA device is resuming from runtime suspend, ipa_start_xmit() stops the transmit queue and relies on a work item scheduled by the runtime resume callback to restart it. Because that work can run before the device reaches the ACTIVE power state, its wake is consumed too early and nothing remains to restart the queue once the resume completes. The modem transmit queue then stops permanently: packets accumulate behind the stopped queue, the device runtime-suspends, and because the network device does not implement ndo_tx_timeout the watchdog never fires. On affected hardware this results in a permanent denial of service of the cellular data path, affecting both transmit and receive.

Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 (including the kernel-ivos-qualcomm component) are affected, and the fix is currently deferred for these streams, so systems running them remain exposed to this timing-dependent stall until a fix is released. Earlier Red Hat Enterprise Linux versions (6, 7, 8, and 9) and the RHEL CoreOS kernels shipped with Red Hat OpenShift are not affected because the vulnerable code, introduced upstream in the 6.9 kernel, is not present in those kernel trees.

The severity assigned by CVE.org (7.5, network attack vector) differs from Red Hat's assessment (CVSS 5.5, local attack vector) because triggering the flaw requires local transmission of packets over the IPA modem interface racing a runtime power-management transition, rather than a remote network-based attack.