CVE-2026-43031
Published: 01 May 2026
Summary
CVE-2026-43031 is a high-severity an unspecified weakness vulnerability in Linux Linux Kernel. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 17.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SC-5 (Denial-of-service Protection).
Deeper analysis
CVE-2026-43031 is a vulnerability in the Linux kernel's Xilinx AXI Ethernet (axienet) driver, affecting Byte Queue Limits (BQL) accounting for transmit (TX) packets that span multiple buffer descriptors (BDs) in scatter-gather operations. When such a packet completes across multiple NAPI polls, the driver sums per-BD actual lengths into an accumulator that resets per poll, causing earlier bytes to be lost and never credited to BQL. This results in BQL perceiving bytes as permanently in-flight, eventually stalling the TX queue and disrupting network transmission.
A remote attacker with network access can exploit this vulnerability without privileges or user interaction, as indicated by its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). By triggering the transmission of scatter-gather packets that complete across NAPI polls, the attacker can cause the affected axienet interface to stall its TX queue, leading to a denial-of-service condition on the network device.
Mitigation involves applying kernel patches from the referenced stable commits, which fix the issue by using skb->len from the last BD of a packet for byte counting upon its completion, matching the netdev_sent_queue() debit and ensuring accurate BQL accounting across polls. The patches are available at: https://git.kernel.org/stable/c/2a0323a913109b52bfc9f5ea7b92a1b249e07d3e, https://git.kernel.org/stable/c/3c3a6b9020c01fde7b22e8550105de0b59904f61, and https://git.kernel.org/stable/c/d1978d03e86785872871bff9c2623174b10740de.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26630
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets When a TX packet spans multiple buffer descriptors (scatter-gather), axienet_free_tx_chain sums the per-BD actual length from descriptor status into a…
more
caller-provided accumulator. That sum is reset on each NAPI poll. If the BDs for a single packet complete across different polls, the earlier bytes are lost and never credited to BQL. This causes BQL to think bytes are permanently in-flight, eventually stalling the TX queue. The SKB pointer is stored only on the last BD of a packet. When that BD completes, use skb->len for the byte count instead of summing per-BD status lengths. This matches netdev_sent_queue(), which debits skb->len, and naturally survives across polls because no partial packet contributes to the accumulator.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables remote exploitation of kernel driver logic bug to stall TX queue, directly mapping to Application or System Exploitation for Endpoint Denial of Service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely remediation through application of the specified kernel patches directly corrects the BQL accounting flaw in the axienet driver, preventing TX queue stalls from scatter-gather packets.
Denial-of-service protection mechanisms, such as traffic rate limiting on the affected network interface, mitigate exploitation by restricting scatter-gather traffic that triggers the BQL accounting issue.
System monitoring of network interface TX queue states and transmission metrics detects stalls caused by the axienet driver's incomplete BQL byte crediting across NAPI polls.