The ipa driver in the Linux kernel contains a flaw that can cause the transmit queue to stall during a runtime resume. When a packet transmission initiates, the queue is stopped and a wake work is scheduled before the device reaches an active power state. The work then consumes the wake too early, leaving the queue stopped and queued packets stranded. As a result, the cellular data path becomes permanently deaf, packets pile in the queue, and the device eventually runtime‑suspends without a watchdog timeout. This loss of connectivity manifests as a denial of service to the affected network interface.

This issue exists in the Linux kernel’s ipa network subsystem, affecting any device that relies on that driver, such as the Fairphone 6’s SM7635 modem. The vulnerability is tied to the kernel’s runtime power management and is present in all current kernels that have not yet applied the corrective commit. Both Linux vendors are listed as affected, so any installation of an unpatched kernel on a Linux host with an ipa‑enabled modem is susceptible.

The CVSS score of 4.7 places the flaw in the moderate range, and the EPSS score is not available, suggesting a low to moderate exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The flaw does not rely on remote code execution; a local or potentially remote attacker would need to trigger a resume cycle on the device for the issue to manifest. Due to its nature as a kernel bug and the lack of a documented exploit, the risk is moderate but could lead to significant service disruption in production environments.