In the Linux kernel, the following vulnerability has been resolved:
net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets
When a TX packet spans multiple buffer descriptors (scatter-gather),
axienet_free_tx_chain sums the per-BD actual length from descriptor
status into a caller-provided accumulator. That sum is reset on each
NAPI poll. If the BDs for a single packet complete across different
polls, the earlier bytes are lost and never credited to BQL. This
causes BQL to think bytes are permanently in-flight, eventually
stalling the TX queue.
The SKB pointer is stored only on the last BD of a packet. When that
BD completes, use skb->len for the byte count instead of summing
per-BD status lengths. This matches netdev_sent_queue(), which debits
skb->len, and naturally survives across polls because no partial
packet contributes to the accumulator.
Security readout for executives and security teams
Plain-English summary
A flaw in the Linux Xilinx AXI Ethernet driver can incorrectly track transmitted data when one packet uses multiple descriptors. Over time, the driver may believe data remains in flight and stop the transmit queue, causing network availability loss. The supplied CVSS score is 7.5 and affects availability only.
Executive priority
Prioritize remediation on production, embedded, or infrastructure systems actively using Xilinx AXI Ethernet. The primary business risk is loss of network transmission rather than data theft or modification. Use an expedited maintenance window where interface failure would disrupt critical services, while confirming branch-specific packages with the vendor.
Technical view
The axienet driver previously accumulated completed descriptor lengths within each NAPI poll. When one packet completed across multiple polls, earlier byte counts were discarded. BQL therefore retained an incorrect outstanding-byte balance and could stall transmission. The fix credits skb->len when the packet’s final descriptor completes, matching netdev_sent_queue() accounting.
Likely exposure
Exposure is limited to Linux systems using the Xilinx axienet driver where transmitted packets span multiple buffer descriptors. The bundle identifies affected versions including 6.15, 6.18.22, 6.19.12, and 7.0, but its version formatting is ambiguous. Confirm exact affected ranges with the applicable kernel or distribution advisory.
Exploitation context
The supplied vector describes network-reachable, low-complexity, unauthenticated availability impact. However, the bundle provides no evidence of public exploitation or active attacks, and the CVE is not identified as KEV. Treat deliberate remote triggering as possible according to the score, but unconfirmed by the cited evidence.
Researcher notes
The vulnerability is an accounting defect rather than memory corruption. Assessment should focus on axienet presence, scatter-gather transmission, completion behavior across NAPI polls, and whether a vendor kernel backported the fix. The supplied records do not establish exact vulnerable interval boundaries, exploit availability, observed attacks, or a source-backed workaround.
Mitigation direction
Apply a vendor-supported kernel update incorporating the applicable cited stable fix.
Check distribution and hardware-vendor guidance for the fixed package version applicable to each kernel branch.
If updating is delayed, follow vendor guidance for temporary controls; the supplied sources provide no specific workaround.
Validation and detection
Inventory systems using the Xilinx AXI Ethernet axienet driver.
Confirm each installed kernel contains the applicable cited stable commit or an equivalent vendor backport.
Review affected interfaces for recurring transmit-queue stalls associated with multi-descriptor packet processing.
After remediation, test sustained transmission and verify the queue no longer stalls from incorrect BQL accounting.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2026-43031 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
1CVSS vectors
3Timeline events
0ADP providers
4Source links
CVSS vector scores
1 official score
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.