CVE-2026-43031

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43031", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.977Z", "datePublished": "2026-05-01T14:15:31.256Z", "dateUpdated": "2026-08-05T12:25:24.979Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:25:24.979Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xilinx: axienet: Fix BQL accounting for multi-BD TX packets\n\nWhen a TX packet spans multiple buffer descriptors (scatter-gather),\naxienet_free_tx_chain sums the per-BD actual length from descriptor\nstatus into a caller-provided accumulator. That sum is reset on each\nNAPI poll. If the BDs for a single packet complete across different\npolls, the earlier bytes are lost and never credited to BQL. This\ncauses BQL to think bytes are permanently in-flight, eventually\nstalling the TX queue.\n\nThe SKB pointer is stored only on the last BD of a packet. When that\nBD completes, use skb->len for the byte count instead of summing\nper-BD status lengths. This matches netdev_sent_queue(), which debits\nskb->len, and naturally survives across polls because no partial\npacket contributes to the accumulator."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable cleanup runs on transmitted packets for a network interface; in a reasonable embedded/router/server deployment, an unauthenticated remote peer can cause multi-fragment replies or forwarded traffic to be transmitted through the affected axienet device.\nAC:L - The trigger is repeated multi-BD scatter-gather TX completion with descriptors split across NAPI polls, which can be induced through sustained traffic and does not require winning an attacker-uncontrolled race.\nPR:N - No local privileges are needed in the network-triggered scenario because packets from a remote peer can cause the host or forwarding device to transmit through the affected interface.\nUI:N - Once the affected interface is up and carrying traffic, exploitation does not require any user action by a victim.\nS:U - The impact remains within the kernel/network device availability scope and does not cross a virtualization, sandbox, or separate security authority boundary.\nC:N - The bug is an accounting mismatch in BQL byte completion reporting; it does not expose memory contents or create a read primitive.\nI:N - The vulnerable path does not corrupt memory or attacker-controlled data; it under-credits completed TX bytes and affects queue state only.\nA:H - Repeated under-accounting makes BQL believe bytes remain permanently in flight, eventually stalling the TX queue and causing a persistent denial of transmit service on the affected network interface."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/xilinx/xilinx_axienet_main.c"], "versions": [{"version": "c900e49d58eb32b192b6d200ace4ae3ab89779d4", "lessThan": "2a0323a913109b52bfc9f5ea7b92a1b249e07d3e", "status": "affected", "versionType": "git"}, {"version": "c900e49d58eb32b192b6d200ace4ae3ab89779d4", "lessThan": "3c3a6b9020c01fde7b22e8550105de0b59904f61", "status": "affected", "versionType": "git"}, {"version": "c900e49d58eb32b192b6d200ace4ae3ab89779d4", "lessThan": "d1978d03e86785872871bff9c2623174b10740de", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/xilinx/xilinx_axienet_main.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.22", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.22"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.19.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2a0323a913109b52bfc9f5ea7b92a1b249e07d3e"}, {"url": "https://git.kernel.org/stable/c/3c3a6b9020c01fde7b22e8550105de0b59904f61"}, {"url": "https://git.kernel.org/stable/c/d1978d03e86785872871bff9c2623174b10740de"}], "title": "net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/xilinx/xilinx_axienet_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2a0323a913109b52bfc9f5ea7b92a1b249e07d3e", "status": "affected", "version": "c900e49d58eb32b192b6d200ace4ae3ab89779d4", "versionType": "git"}, {"lessThan": "3c3a6b9020c01fde7b22e8550105de0b59904f61", "status": "affected", "version": "c900e49d58eb32b192b6d200ace4ae3ab89779d4", "versionType": "git"}, {"lessThan": "d1978d03e86785872871bff9c2623174b10740de", "status": "affected", "version": "c900e49d58eb32b192b6d200ace4ae3ab89779d4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/xilinx/xilinx_axienet_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.22", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A0B69104-1744-49F9-BFD7-533364994A3E", "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xilinx: axienet: Fix BQL accounting for multi-BD TX packets\n\nWhen a TX packet spans multiple buffer descriptors (scatter-gather),\naxienet_free_tx_chain sums the per-BD actual length from descriptor\nstatus into a caller-provided accumulator. That sum is reset on each\nNAPI poll. If the BDs for a single packet complete across different\npolls, the earlier bytes are lost and never credited to BQL. This\ncauses BQL to think bytes are permanently in-flight, eventually\nstalling the TX queue.\n\nThe SKB pointer is stored only on the last BD of a packet. When that\nBD completes, use skb->len for the byte count instead of summing\nper-BD status lengths. This matches netdev_sent_queue(), which debits\nskb->len, and naturally survives across polls because no partial\npacket contributes to the accumulator."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: xilinx: axienet: Correcci\u00f3n de la contabilidad BQL para paquetes TX multi-BD\n\nCuando un paquete TX abarca m\u00faltiples descriptores de b\u00fafer (scatter-gather), axienet_free_tx_chain suma la longitud real por BD del estado del descriptor en un acumulador proporcionado por el llamador. Esa suma se restablece en cada sondeo NAPI. Si los BDs para un solo paquete se completan a trav\u00e9s de diferentes sondeos, los bytes anteriores se pierden y nunca se acreditan a BQL. Esto hace que BQL piense que los bytes est\u00e1n permanentemente en tr\u00e1nsito, lo que eventualmente detiene la cola TX.\n\nEl puntero SKB se almacena solo en el \u00faltimo BD de un paquete. Cuando ese BD se completa, use skb -> len para el recuento de bytes en lugar de sumar las longitudes de estado por BD. Esto coincide con netdev_sent_queue(), que debita skb -> len, y naturalmente sobrevive a trav\u00e9s de los sondeos porque ning\u00fan paquete parcial contribuye al acumulador."}], "id": "CVE-2026-43031", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-05-01T15:16:47.680", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2a0323a913109b52bfc9f5ea7b92a1b249e07d3e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3c3a6b9020c01fde7b22e8550105de0b59904f61"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d1978d03e86785872871bff9c2623174b10740de"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets", "id": "2464364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464364"}, "csaw": false, "cwe": "CWE-911", "details": ["A flaw was found in the Linux kernel's xilinx axienet network driver. This vulnerability arises from incorrect accounting of Buffer Queue Length (BQL), a mechanism that manages network buffer usage, for transmit (TX) packets that are split across multiple buffer descriptors. If these packet segments complete across different processing cycles, the system miscalculates the transmitted data. This error can cause the TX queue to stall, leading to a Denial of Service (DoS) for network communications."], "name": "CVE-2026-43031", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43031\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43031\nhttps://lore.kernel.org/linux-cve-announce/2026050101-CVE-2026-43031-f267@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c900e49d58eb32b192b6d200ace4ae3ab89779d4,2a0323a913109b52bfc9f5ea7b92a1b249e07d3e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c900e49d58eb32b192b6d200ace4ae3ab89779d4,3c3a6b9020c01fde7b22e8550105de0b59904f61)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c900e49d58eb32b192b6d200ace4ae3ab89779d4,d1978d03e86785872871bff9c2623174b10740de)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.22,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.12,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-01T18:45:15.323699+00:00", "updated": "2026-05-08T22:45:05.415258+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}