CVE-2026-80997

A flaw was found in the Linux kernel's IP Accelerator (IPA) network driver. Specifically, the ipa_start_xmit() function incorrectly manages the transmit (TX) queue during a device's runtime resume process. This can lead to the TX queue stopping permanently because the mechanism intended to restart it is consumed prematurely. Consequently, the cellular data path can become unresponsive, resulting in a Denial of Service (DoS) for network communication.

A low-impact race condition was found in the Linux kernel's IP Accelerator (IPA) network driver used with Qualcomm modem hardware. When a local process transmits packets while the IPA device is resuming from runtime suspend, ipa_start_xmit() stops the transmit queue and relies on a work item scheduled by the runtime resume callback to restart it. Because that work can run before the device reaches the ACTIVE power state, its wake is consumed too early and nothing remains to restart the queue once the resume completes. The modem transmit queue then stops permanently: packets accumulate behind the stopped queue, the device runtime-suspends, and because the network device does not implement ndo_tx_timeout the watchdog never fires. On affected hardware this results in a permanent denial of service of the cellular data path, affecting both transmit and receive.

Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 (including the kernel-ivos-qualcomm component) are affected, and the fix is currently deferred for these streams, so systems running them remain exposed to this timing-dependent stall until a fix is released. Earlier Red Hat Enterprise Linux versions (6, 7, 8, and 9) and the RHEL CoreOS kernels shipped with Red Hat OpenShift are not affected because the vulnerable code, introduced upstream in the 6.9 kernel, is not present in those kernel trees.

The severity assigned by CVE.org (7.5, network attack vector) differs from Red Hat's assessment (CVSS 5.5, local attack vector) because triggering the flaw requires local transmission of packets over the IPA modem interface racing a runtime power-management transition, rather than a remote network-based attack.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.