CVE-2026-43031 Overview
CVE-2026-43031 is a Linux kernel vulnerability in the Xilinx AXI Ethernet driver (drivers/net/ethernet/xilinx/xilinx_axienet). The flaw affects Byte Queue Limits (BQL) accounting when a TX packet spans multiple buffer descriptors (BDs) using scatter-gather. The function axienet_free_tx_chain accumulates per-BD lengths into a counter that resets on each NAPI poll. When BDs for a single packet complete across separate polls, byte counts are lost and never credited to BQL. The transmit queue eventually stalls because BQL believes bytes remain permanently in flight.
Critical Impact
Remote network traffic patterns can trigger TX queue stalls on systems using the Xilinx AXI Ethernet driver, producing a high-availability denial of service condition.
Affected Products
- Linux kernel versions containing the unpatched xilinx_axienet driver
- Systems using Xilinx AXI Ethernet hardware with scatter-gather TX
- Embedded and FPGA-based platforms relying on the affected driver
Discovery Timeline
- 2026-05-01 - CVE-2026-43031 published to NVD
- 2026-05-03 - Last updated in NVD database
Technical Details for CVE-2026-43031
Vulnerability Analysis
The Xilinx AXI Ethernet driver manages TX completion through axienet_free_tx_chain. For scatter-gather packets, an SKB is split across multiple buffer descriptors. The driver sums each BD's actual length from descriptor status into a caller-supplied accumulator. NAPI polling resets this accumulator on every invocation.
When the BDs for a single packet complete across two or more NAPI poll cycles, the partial byte count from the earlier poll is discarded. Those bytes are never reported to netdev_completed_queue(). BQL continues to track them as in-flight, gradually consuming the available queue limit. Once the limit is exhausted, the kernel stops dispatching frames to the device, and the TX queue stalls.
This flaw produces a high-availability impact without requiring authentication or user interaction. An attacker capable of generating sustained network load can induce stalls on affected hosts, disrupting services that depend on the interface.
Root Cause
The accumulator pattern in axienet_free_tx_chain does not survive across NAPI poll boundaries. Per-BD length summation works only when all descriptors of a packet complete in the same poll. The SKB pointer is stored exclusively on the last BD of a packet, but the byte count is derived from descriptor status rather than skb->len.
Attack Vector
A remote attacker sends crafted or high-volume traffic that triggers scatter-gather TX with descriptor completions split across NAPI polls. Repeated occurrences exhaust BQL's tracked byte budget. The interface eventually halts transmission until the queue is reset or the driver reloaded. The vulnerability requires no privileges and no user interaction.
The fix changes the accounting model. When the final BD of a packet completes, the driver uses skb->len for the byte count instead of summing per-BD status lengths. This matches netdev_sent_queue(), which debits skb->len, and survives NAPI poll boundaries because no partial packet contributes to the running total.
Detection Methods for CVE-2026-43031
Indicators of Compromise
- Sustained TX queue stalls on interfaces backed by the xilinx_axienet driver
- netdev watchdog timeouts logged in dmesg for the affected interface
- Growing discrepancy between BQL inflight counters and actual driver state in /sys/class/net/<iface>/queues/tx-*/byte_queue_limits/
Detection Strategies
- Monitor kernel logs for repeated TX timeouts or carrier resets on Xilinx AXI Ethernet interfaces
- Inspect ethtool -S <iface> counters for stalled TX statistics combined with non-zero pending descriptors
- Correlate interface throughput drops with NAPI poll frequency on systems running affected kernel versions
Monitoring Recommendations
- Track kernel version inventory across embedded and FPGA platforms to identify exposure
- Alert on NETDEV WATCHDOG messages in centralized log pipelines
- Baseline TX byte counters per interface and flag prolonged zero-throughput periods on otherwise active links
How to Mitigate CVE-2026-43031
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by commits 2a0323a, 3c3a6b9, and d1978d0 to the affected stable trees
- Identify all hosts running the xilinx_axienet driver and prioritize patch deployment on production network paths
- Reboot or reload the driver after updating to clear any persistent BQL state
Patch Information
The fix is committed to the upstream Linux kernel. Refer to Kernel Git Commit 2a0323a, Kernel Git Commit 3c3a6b9, and Kernel Git Commit d1978d0 for the corrected accounting logic that uses skb->len on final-BD completion.
Workarounds
- Disable scatter-gather offload on the affected interface using ethtool -K <iface> sg off to force single-BD packets, accepting a performance trade-off
- Implement automated interface recovery scripts that detect TX stalls and reset the queue until patches are applied
- Restrict untrusted network exposure on hosts that cannot be patched immediately
# Configuration example: disable scatter-gather as a temporary workaround
ethtool -K eth0 sg off
ethtool -K eth0 tso off
ethtool -K eth0 gso off
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
