* [CVE-2026-80997][LOW] net: ipa: fix stalled modem TX queue after runtime resume
@ 2026-09-11 20:43 21% AL-KERNEL
0 siblings, 0 replies; 1+ results
From: AL-KERNEL @ 2026-09-11 20:43 UTC (permalink / raw)
To: kernel-cve
CVE: CVE-2026-80997
Priority: LOW
AL-KERNEL base severity: LOW
KPANIC flag: NO
Patch: net: ipa: fix stalled modem TX queue after runtime resume
Commit: 30d5226bac52073c91ce85c2dcff93b866baefdb
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=30d5226bac52073c91ce85c2dcff93b866baefdb
Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-80997
Analysis date: Fri, 11 Sep 2026 16:43:51 -0400
ActionableScore: 2
ActionableScore lower bound: unknown
Actionable bucket: Ordinary Moderate
Manual review required: NO
Summary:
No one-sentence report phrase was found.
======================================================================
ABOUT THIS REPORT
======================================================================
The original Linux kernel CVE announcement for CVE-2026-80997 is available here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-80997
The original announcement does not normally provide a security severity
estimate, CVSS assessment, or enough information to determine whether the
reported kernel bug represents a practically relevant security issue.
This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin. It combines
an autonomous classifier with LLM-assisted technical analysis and a
separate ActionableScore mechanism.
The purpose of this report is to prioritize Linux kernel CVEs before
manual review, identify cases that require prompt investigation, and
support automatic closure of issues that are unlikely to have meaningful
security impact.
Published priority for this report: LOW
Manual review required: NO
A detailed explanation of the methodology and priority rules is included
at the end of this message.
======================================================================
AL-KERNEL CLASSIFICATION RESULT
======================================================================
CVE-2026-80997 LOW https://www.kernelcve.org/list/?q=CVE-2026-80997 CHECK WITH IMPACT FROM ORIG NN MODERATE Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H';CWE-362;CWE-662;CWE-755;Other CVSS 'AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H';BEST CVSS score: '5.5';DESCR 'A runtime PM ordering race in the IPA modem transmit path can leave the modem TX queue permanently stopped. ipa_start_xmit stops the queue and relies on runtime resume wake work to restart it, but that work can run while the device is still RPM_RESUMING rather than RPM_ACTIVE. A transmit that runs in this window can stop the queue again and receive EINPROGRESS from pm_runtime_get without any later wake being scheduled. For the CVSS the PR:L because a local user or local process able to generate outbound traffic over the cellular interface can contribute to triggering the condition, while administrative privileges are not clearly required. The issue is not directly network reachable because the trigger is the local transmit path and runtime PM state transition rather than packets received from a remote peer. Impact is denial of service for the cellular data path, with packets stranded behind a stopped queue and no clear evidence of memory corruption or privilege escalation.';NO MANUAL CHECK; ,and ActionableScore result is Ordinary Moderate (with actual score 2) SKIP CVE-2026-80997 UNKNOWN SKIP The Fixes patch not applied yet, so unlikely that actual: url YES NO NO unknown MAYBE NETWORK HARDWARE LINUS TEST QDISC PACKET DECREASED_TO_MODERATE_REGULAR_FROM_MODERATE7_BASED_ON_GUESSCVSS_AND_CIANNH DECREASED_TO_LOW_FROM_MODERATE_BASED_ON_ACTIONABLESCORELESSTHAN3 - - checked
======================================================================
ACTIONABLESCORE ANALYSIS
======================================================================
ActionableScore=2
PrimitiveClass=CLASS_C
RealUAF=NO
HostAdminRequired=NO
NamespaceScopedPrivilege=NO
ImportantCandidate=NO
ManualReview=NO
AutoDowngradeAllowed=YES
1. ActionableScore
* Raw conservative score: 2
* Conservative score: 2. No floor or cap applied.
* Raw paranoid score: 2
* Paranoid score: 2. No floor or cap applied.
* Final recommended bucket: **Ordinary Moderate**::
2. Signal breakdown
Positive signals:
* +1 Local below-host-admin trigger. A local user or local process can contribute to triggering the condition by generating outbound traffic over the cellular interface when the affected IPA modem path is active.
* +1 Device-level persistent DoS. The supplied evidence shows the modem TX queue can remain permanently stopped, packets can remain stranded behind the qdisc, and the cellular data path can become deaf until recovery.
Negative or non-awarded signals:
* RealUAF not awarded. No stale post-lifetime object use, double release, refcount mutation, RCU lifetime violation, or freed object access is established.
* Memory corruption not awarded. The patch fixes runtime PM ordering and queue wake sequencing, not an overwrite, UAF, OOB access, or type confusion.
* Reliable kernel crash not awarded. The demonstrated consequence is a persistent cellular modem data-path stall, not host-wide panic or kernel crash.
* Extra availability not awarded. The cellular outage is already counted as the device-level DoS signal.
* Remote reachable not awarded. The vulnerable operation is reached through local transmit and runtime PM state transitions, not directly by attacker-controlled inbound network packets.
* Confidentiality and integrity not awarded. No disclosure, unauthorized modification, privilege escalation, or security-boundary bypass is indicated.
* Race penalty not applied. Although this is a race or ordering window, the condition is reproducible under accelerated autosuspend and normal operation was observed to fail within hours, so the timing is not treated as a hard one-shot race.
* Hardware rarity penalty not applied. The issue is hardware-specific to IPA modem deployments, but the evidence does not justify treating it as rare physical-only access for scoring purposes.
3. Reachability analysis
The evaluated attacker is a local below-host-admin user or process that can generate outbound traffic over an already configured cellular interface. Administrative privileges are not clearly required for the traffic generation stage, although normal device provisioning and cellular interface setup are assumed to be performed by the system.
The issue is not namespace-scoped in the relevant sense. The trigger does not depend on a namespace-local capability such as CAP_NET_ADMIN inside an attacker-created namespace.
The issue is not directly network reachable. A remote peer may receive or fail to receive traffic, but the vulnerable sequence is the local transmit path interacting with runtime PM resume state.
Prior privileged setup may exist in the practical deployment because the cellular modem and network interface must already be configured, but that setup is not the vulnerability trigger itself. Special IPA modem hardware is required. The race is repeatable enough to be demonstrated by the supplied reproducer and observed in the field, but it remains a functional availability failure rather than a corruption primitive.
4. Primitive and severity interpretation
The exact primitive is a runtime PM ordering bug where ipa_modem_wake_queue_work can wake the TX queue before the device reaches RPM_ACTIVE. A transmit in that window can stop the queue again, receive EINPROGRESS from pm_runtime_get, and leave no later wake scheduled.
This is not active structured UAF and not fixed stale storage. It is an invalid queue and power-state synchronization condition. There is no concrete repeated release or refcount operation. There is no first lifetime operation that may free an object and no second lifetime mutation through a dangling reference.
PrimitiveClass is CLASS_C because the demonstrated behavior is denial of service or invalid state without an independently useful corruption, ownership, authorization, or lifetime primitive. The demonstrated consequence is cellular data-path DoS. The speculative consequence beyond device/network availability is not supported by the patch.
ImportantCandidate is NO because there is no memory corruption, no security-boundary bypass, no privilege escalation path, no kernel crash, and no unresolved lifetime/refcount corruption leverage. AutoDowngradeAllowed is YES because the issue is a device data-path DoS only and does not contain a concrete primitive that would be lost by ordinary Moderate handling.
Operational severity is Low-like to ordinary Moderate for security triage, while still potentially significant as a functional reliability bug on affected mobile devices.
5. One-sentence report phrase
A runtime PM ordering race in the IPA modem transmit path can permanently stop the cellular TX queue and cause a local cellular data-path denial of service, but no memory corruption, privilege escalation, or direct remote trigger is established.
6. Manual review recommendation
NO MANUAL CHECK NEEDED
Reason: this is a DoS-only runtime PM and queue wake ordering issue with no UAF, no refcount corruption, no host crash, no authorization bypass, and no plausible privilege escalation primitive shown.
7. Call-site confidence
Call-site confidence: high
======================================================================
UPSTREAM PATCH SUMMARY
======================================================================
Patch: net: ipa: fix stalled modem TX queue after runtime resume
Commit: 30d5226bac52073c91ce85c2dcff93b866baefdb
Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=30d5226bac52073c91ce85c2dcff93b866baefdb
Commit description:
ipa_start_xmit() unconditionally stops the TX queue before calling
pm_runtime_get(), relying on the wake scheduled by runtime resume
(ipa_modem_wake_queue_work()) to restart it once power is ACTIVE.
But that work is queued from within the runtime resume callback,
before the device's power state reaches RPM_ACTIVE, so it can run
while the device is still RPM_RESUMING. The wake is then consumed
too early: the transmit it restarts stops the queue again,
pm_runtime_get() returns -EINPROGRESS without arranging any future
wake (deferred_resume exists only for RPM_SUSPENDING), and after the
resume completes nothing is left to wake the queue. Transmit stalls
permanently: packets pile up in the qdisc behind the stopped queue,
the device runtime-suspends, and since the netdev registers no
ndo_tx_timeout the watchdog never fires. Observed on SM7635
(Fairphone 6) as the cellular data path going permanently deaf
within hours, RX included, since nothing resumes the suspended
endpoints.
Close the window by making the wake work wait for the resume to
complete (pm_runtime_get_sync()) before waking the queue. Every
queue stop is then guaranteed a later wake that happens while power
is ACTIVE; a transmit racing a new suspend/resume cycle re-schedules
the work. If the device could not be resumed, wake the queue anyway
so pending packets are dropped by the transmit path rather than
stranded.
The STARTED power flag used to narrow this window: a wake running
before the transmit path's stop suppressed that stop, but only once,
as the flag was cleared by the first stop it absorbed. Removing the
flag made a single transmit during an in-flight resume sufficient to
strand the queue, which is the form observed.
With an accelerated reproducer (autosuspend delay shortened to 5 ms,
~20 packets/s of TX), an unpatched kernel stalled three times in
230 s / 4380 packets; with this patch the same test ran 3601 s /
70298 packets without a stall.
Fixes: 688de12 ("net: ipa: kill the STARTED IPA power flag")
Cc: [email protected]
Signed-off-by: Jorijn van der Graaf <[email protected]>
Reviewed-by: Simon Horman <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Jakub Kicinski <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Changed files:
drivers/net/ipa/ipa_modem.c
Diff excerpt:
Not included in this email. See the upstream URL for the full patch.
Full patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=30d5226bac52073c91ce85c2dcff93b866baefdb
======================================================================
DETAILED REPORT METHODOLOGY
======================================================================
The original Linux kernel CVE announcement for CVE-2026-80997 can be found here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-80997
The original CVE announcement normally does not include a security-level
estimate. In particular, it may not contain a CVSS assessment, an impact
level, or enough information to determine whether the reported bug is a
practically relevant security issue. One purpose of this parallel CVE list
is to provide that missing technical and prioritization information.
The original goal of the AL-KERNEL project was to prioritize Linux kernel
CVE analysis automatically before manual review. The system can also help
identify non-security issues that may be suitable for automatic closure.
This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin.
The first analysis stage combines an autonomous classifier with additional
LLM-based analysis. The autonomous classifier runs locally on a CPU and is
based on a backpropagation neural network. Together, these mechanisms
produce a technical vulnerability description, identify likely weakness
types, estimate CVSS severity, and provide input for ActionableScore.
Two CVSS estimates are retained because incomplete kernel vulnerability
information often permits more than one defensible interpretation:
Conservative CVSS vector: AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
The Best / paranoid CVSS vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
The Best / paranoid CVSS score: 5.5
The conservative vector represents a lower-impact interpretation.
The Best/paranoid vector intentionally represents a plausible upper-bound
interpretation and should not automatically be treated as demonstrated
real-world impact.
CVSS may also need to be adjusted for a particular Linux deployment,
because actual reachability, privileges, enabled kernel configuration,
hardware, namespaces, exposed device nodes, and other environmental
conditions can differ significantly between systems.
A separate ActionableScore mechanism evaluates practical remediation
urgency. Its analysis may include reachability, attack prerequisites,
subsystem exposure, memory-corruption characteristics, denial-of-service
reliability, and possible confidentiality, integrity, or
privilege-escalation impact.
Conservative ActionableScore: unknown
Paranoid ActionableScore: 2
The final base severity is taken directly from the second tab-separated
field of the AL-KERNEL classification result. ActionableScore does not
replace or independently override that final AL-KERNEL decision, and
if ActionableScore adjusted impact level of ALKERNEL, then you would see
self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7.
For an AL-KERNEL result of MODERATE, this report uses the following
additional presentation split:
ActionableScore below 5 -> MODERATE REGULAR
ActionableScore 5 or more -> MODERATE 7.0
The distinction between MODERATE REGULAR and MODERATE 7.0 makes it
possible to identify Moderate issues that should receive manual analysis
and fixes before lower-priority MODERATE REGULAR issues. In many cases,
MODERATE REGULAR fixes may wait for a later rebase or routine update.
There is one override in which MODERATE REGULAR becomes MODERATE 7.0
even when the ActionableScore is below 5. When the AL-KERNEL result
contains the KPANIC flag, a MODERATE result is always presented as
MODERATE 7.0. The KPANIC flag selected with few regexps without
usage of AI at all, so it helps to detect cases when Kernel Crash happens
and similar (to filter False-Negative results from the LLM usage).
KPANIC indicates that a reliable kernel crash, kernel panic, or similarly
serious kernel availability impact was identified by the classification
workflow.
AL-KERNEL base severity for this report: LOW
KPANIC detected for this report: NO
Published priority for this report (same as in Subject): LOW
These results are intended to support engineering triage. They are
machine-generated estimates, and cases marked for manual review should
be validated by a human security engineer before final disposition.
For more info read docs linked from here: https://kernelcve.org/
(and you can submit you own patch there to generate such a report
for non-existant CVE-id yet).
Note that in many cases this AI tool selects higher severity, than
real is (means you can expect Importants instead of Moderate 7.0 or
Moderates 7.0 instead of regular Moderates). If you see such cases,
please use reply email interface to add additional manual analyses
info to this particular CVE.
And please, please, let me know when you see Lows instead of Importants
or Important instead of Low (because particular for such cases I
need to tune this AI tool to make it better for this one and next similar).
My contact email for such notifications is [email protected] (and both
send reply to CVE record itself too and see "reply" button below for howto reply).
^ permalink raw reply [relevance 21%]
Results 1-1 of 1 | reverse | sort options + mbox downloads above
-- links below jump to the message on this page --
2026-09-11 20:43 21% [CVE-2026-80997][LOW] net: ipa: fix stalled modem TX queue after runtime resume AL-KERNEL
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox