Executive brief
The Linux kernel's IPA (Internet Packet Accelerator) network driver contains a race condition that can cause the modem's transmit queue to permanently stop responding after a power state transition. This leads to cellular data becoming unavailable within hours of normal operation, affecting both sending and receiving of cellular traffic until the device is manually restarted.
Technical details
The vulnerability is a race condition (CWE-362) in the ipa_start_xmit() function where a wake-up work queue is scheduled before the device reaches active power state (RPM_ACTIVE). The work consumes the wake-up notification while the device is still in RPM_RESUMING state, causing the subsequent transmit operation to stop the queue again with no further wake scheduled. The transmit path never resumes, leaving packets stranded in the qdisc and allowing the device to suspend without any mechanism to reawaken the TX queue. An accelerated test case reproduced the stall 3 times in 230 seconds on an unpatched kernel. The fix uses pm_runtime_get_sync() to ensure the wake work completes only after power is fully ACTIVE, guaranteeing every queue stop has a corresponding wake while the device is powered.
Affected products
- Linux Linux kernel prior to fix
Timeline
- 2026-09-11: disclosed