CVE-2026-43031

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets

When a TX packet spans multiple buffer descriptors (scatter-gather),

axienet_free_tx_chain sums the per-BD actual length from descriptor

status into a caller-provided accumulator. That sum is reset on each

NAPI poll. If the BDs for a single packet complete across different

polls, the earlier bytes are lost and never credited to BQL. This

causes BQL to think bytes are permanently in-flight, eventually

stalling the TX queue.

The SKB pointer is stored only on the last BD of a packet. When that

BD completes, use skb->len for the byte count instead of summing

per-BD status lengths. This matches netdev_sent_queue(), which debits

skb->len, and naturally survives across polls because no partial

packet contributes to the accumulator.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References