LiveActive security incident?Get immediate response
CVE Record

CVE-2026-43031: net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets

In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets When a TX packet spans multiple buffer descriptors (scatter-gather), axienet_free_tx_chain sums the per-BD actual length from descriptor status into a caller-provided accumulator. That sum is reset on each NAPI poll. If the BDs for a single packet complete across different polls, the earlier bytes are lost and never credited to BQL. This causes BQL to think bytes are permanently in-flight, eventually stalling the TX queue. The SKB pointer is stored only on the last BD of a packet. When that BD completes, use skb->len for the byte count instead of summing per-BD status lengths. This matches netdev_sent_queue(), which debits skb->len, and naturally survives across polls because no partial packet contributes to the accumulator.

HighCVSS 7.5Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in the Linux Xilinx AXI Ethernet driver can incorrectly track transmitted data when one packet uses multiple descriptors. Over time, the driver may believe data remains in flight and stop the transmit queue, causing network availability loss. The supplied CVSS score is 7.5 and affects availability only.

Executive priority

Prioritize remediation on production, embedded, or infrastructure systems actively using Xilinx AXI Ethernet. The primary business risk is loss of network transmission rather than data theft or modification. Use an expedited maintenance window where interface failure would disrupt critical services, while confirming branch-specific packages with the vendor.

Technical view

The axienet driver previously accumulated completed descriptor lengths within each NAPI poll. When one packet completed across multiple polls, earlier byte counts were discarded. BQL therefore retained an incorrect outstanding-byte balance and could stall transmission. The fix credits skb->len when the packet’s final descriptor completes, matching netdev_sent_queue() accounting.

Likely exposure

Exposure is limited to Linux systems using the Xilinx axienet driver where transmitted packets span multiple buffer descriptors. The bundle identifies affected versions including 6.15, 6.18.22, 6.19.12, and 7.0, but its version formatting is ambiguous. Confirm exact affected ranges with the applicable kernel or distribution advisory.

Exploitation context

The supplied vector describes network-reachable, low-complexity, unauthenticated availability impact. However, the bundle provides no evidence of public exploitation or active attacks, and the CVE is not identified as KEV. Treat deliberate remote triggering as possible according to the score, but unconfirmed by the cited evidence.

Researcher notes

The vulnerability is an accounting defect rather than memory corruption. Assessment should focus on axienet presence, scatter-gather transmission, completion behavior across NAPI polls, and whether a vendor kernel backported the fix. The supplied records do not establish exact vulnerable interval boundaries, exploit availability, observed attacks, or a source-backed workaround.

Mitigation direction

  • Apply a vendor-supported kernel update incorporating the applicable cited stable fix.
  • Check distribution and hardware-vendor guidance for the fixed package version applicable to each kernel branch.
  • If updating is delayed, follow vendor guidance for temporary controls; the supplied sources provide no specific workaround.

Validation and detection

  • Inventory systems using the Xilinx AXI Ethernet axienet driver.
  • Confirm each installed kernel contains the applicable cited stable commit or an equivalent vendor backport.
  • Review affected interfaces for recurring transmit-queue stalls associated with multi-descriptor packet processing.
  • After remediation, test sustained transmission and verify the queue no longer stalls from incorrect BQL accounting.
Prepared
Confidence
medium
Sources
5

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-43031 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2026-43031Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc900e49d58eb32b192b6d200ace4ae3ab89779d4, c900e49d58eb32b192b6d200ace4ae3ab89779d4, c900e49d58eb32b192b6d200ace4ae3ab89779d4unaffected
LinuxLinux6.15, 0, 6.18.22, 6.19.12, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.