Buffer Descriptor Issue in Linux Kernel Found in Xilinx Axienet Driver

CVE-2026-43031

What is CVE-2026-43031?

An issue has been identified in the Linux kernel's handling of transmission packets within the Xilinx Axienet driver. When a transmission (TX) packet spans multiple buffer descriptors (scatter-gather), the mechanism responsible for summing the actual lengths from descriptor status faces a flaw. As a result, the sum of lengths is reset during each NAPI poll, leading to a scenario where data bytes from early sections of a packet can be lost and not credited properly. This mismanagement makes the byte queue limit (BQL) perceive bytes as being indefinitely in-flight, potentially causing a stall in the TX queue. A fix implements the use of skb->len for accurate byte counting, ensuring that partial packets do not contribute erroneously to the accounting process.

References