CVE-2026-43031 net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets
A bug in the Xilinx AXI Ethernet driver causes TX queue stalls when packets span multiple descriptors, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43031?
CVE-2026-43031 is a high-severity denial of service vulnerability in Linux kernel, published on 1 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets
When a TX packet spans multiple buffer descriptors (scatter-gather), axienet_free_tx_chain sums the per-BD actual length from descriptor status into a caller-provided accumulator. That sum is reset on each NAPI poll. If the BDs for a single packet complete across different polls, the earlier bytes are lost and never credited to BQL. This causes BQL to think bytes are permanently in-flight, eventually stalling the TX queue.
The SKB pointer is stored only on the last BD of a packet. When that BD completes, use skb->len for the byte count instead of summing per-BD status lengths. This matches netdev_sent_queue(), which debits skb->len, and naturally survives across polls because no partial packet contributes to the accumulator.
Which versions are affected by CVE-2026-43031?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43031?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-43031 being exploited?
There is no known exploitation of CVE-2026-43031 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43031, DEBIAN-CVE-2026-43031, GHSA-xpr9-pcwr-h574, UBUNTU-CVE-2026-43031.