PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-80997 Linux CVE debrief

A vulnerability in the Linux kernel's net: ipa component can cause a stalled modem TX queue after runtime resume, potentially leading to permanent transmit stalls and impacting network connectivity. This issue arises from the ipa_start_xmit() function unconditionally stopping the TX queue before calling pm_runtime_get(), relying on the wake scheduled by runtime resume (ipa_modem_wake_queue_work()) to restart it once power is ACTIVE. However, the work is queued from within the runtime resume callback, before the device's power state reaches RPM_ACTIVE, causing the wake to be consumed too early. As a result, the transmit path restarts, stops the queue again, and pm_runtime_get() may

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-11
Original CVE updated
2026-09-11
Advisory published
2026-09-11
Advisory updated
2026-09-11

Who should care

Linux kernel developers and maintainers, network administrators, and users of devices running the affected kernel versions should assess exposure and verify that the patch has been applied.

Why it matters

The vulnerability in the Linux kernel's net: ipa component can cause a stalled modem TX queue after runtime resume, potentially leading to permanent transmit stalls and impacting network connectivity. Linux kernel developers and maintainers, network administrators, and users of devices running the affected kernel versions should assess exposure and verify that the patch has been applied.

  • Network connectivity may be impacted due to permanent transmit stalls
  • Device runtime-suspend and resume cycles may be affected
  • Modem TX queue management may require verification

Technical summary

The vulnerability in the Linux kernel's net: ipa component causes a stalled modem TX queue after runtime resume. This can lead to permanent transmit stalls and impact network connectivity. The issue was resolved with a patch that makes the wake work wait for the resume to complete before waking the queue. The patch addresses the problem by ensuring that the queue is not stopped prematurely, allowing the device to properly manage its power state and prevent transmit stalls. The vulnerability was observed on SM7635 (Fairphone 6) and could cause the cellular data path to become permanently deaf within hours. The patch has been applied to the Linux kernel to prevent this issue.

Defensive priority

Medium

Recommended defensive actions

  • Review and apply the patch to the Linux kernel to prevent the stalled modem TX queue issue
  • Monitor network connectivity and modem status to detect potential issues
  • Verify that the device's power state is properly managed to prevent similar issues
  • Perform a thorough review of the system configuration and network setup to identify potential vulnerabilities
  • Implement additional monitoring and logging to detect and respond to potential issues
  • Conduct regular security audits and vulnerability assessments to identify and address potential weaknesses
  • Review and update incident response plans to ensure readiness in case of a security incident

Evidence notes

The vulnerability was resolved in the Linux kernel with a patch that makes the wake work wait for the resume to complete before waking the queue. The issue was observed on SM7635 (Fairphone 6) and could cause the cellular data path to become permanently deaf within hours.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-80997 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-80997

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-80997 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-80997

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/30cef9c1229a36a9c80edb29296459849a2fbaa3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/30d5226bac52073c91ce85c2dcff93b866baefdb

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3cbfd627ee720f3d2460d2cbe2fe9e4130240db6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/62da38b4b3a0dd74a3e0eecf4992d40385924205

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.