159 lines
8.7 KiB
JSON
159 lines
8.7 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-43031",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-05-01T14:12:55.977Z",
|
|
"datePublished": "2026-05-01T14:15:31.256Z",
|
|
"dateUpdated": "2026-08-05T12:25:24.979Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T12:25:24.979Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xilinx: axienet: Fix BQL accounting for multi-BD TX packets\n\nWhen a TX packet spans multiple buffer descriptors (scatter-gather),\naxienet_free_tx_chain sums the per-BD actual length from descriptor\nstatus into a caller-provided accumulator. That sum is reset on each\nNAPI poll. If the BDs for a single packet complete across different\npolls, the earlier bytes are lost and never credited to BQL. This\ncauses BQL to think bytes are permanently in-flight, eventually\nstalling the TX queue.\n\nThe SKB pointer is stored only on the last BD of a packet. When that\nBD completes, use skb->len for the byte count instead of summing\nper-BD status lengths. This matches netdev_sent_queue(), which debits\nskb->len, and naturally survives across polls because no partial\npacket contributes to the accumulator."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"baseScore": 7.5,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - The vulnerable cleanup runs on transmitted packets for a network interface; in a reasonable embedded/router/server deployment, an unauthenticated remote peer can cause multi-fragment replies or forwarded traffic to be transmitted through the affected axienet device.\nAC:L - The trigger is repeated multi-BD scatter-gather TX completion with descriptors split across NAPI polls, which can be induced through sustained traffic and does not require winning an attacker-uncontrolled race.\nPR:N - No local privileges are needed in the network-triggered scenario because packets from a remote peer can cause the host or forwarding device to transmit through the affected interface.\nUI:N - Once the affected interface is up and carrying traffic, exploitation does not require any user action by a victim.\nS:U - The impact remains within the kernel/network device availability scope and does not cross a virtualization, sandbox, or separate security authority boundary.\nC:N - The bug is an accounting mismatch in BQL byte completion reporting; it does not expose memory contents or create a read primitive.\nI:N - The vulnerable path does not corrupt memory or attacker-controlled data; it under-credits completed TX bytes and affects queue state only.\nA:H - Repeated under-accounting makes BQL believe bytes remain permanently in flight, eventually stalling the TX queue and causing a persistent denial of transmit service on the affected network interface."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/ethernet/xilinx/xilinx_axienet_main.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "c900e49d58eb32b192b6d200ace4ae3ab89779d4",
|
|
"lessThan": "2a0323a913109b52bfc9f5ea7b92a1b249e07d3e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "c900e49d58eb32b192b6d200ace4ae3ab89779d4",
|
|
"lessThan": "3c3a6b9020c01fde7b22e8550105de0b59904f61",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "c900e49d58eb32b192b6d200ace4ae3ab89779d4",
|
|
"lessThan": "d1978d03e86785872871bff9c2623174b10740de",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/ethernet/xilinx/xilinx_axienet_main.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.15",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.15",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.22",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.19.12",
|
|
"lessThanOrEqual": "6.19.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.0",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.15",
|
|
"versionEndExcluding": "6.18.22"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.15",
|
|
"versionEndExcluding": "6.19.12"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.15",
|
|
"versionEndExcluding": "7.0"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/2a0323a913109b52bfc9f5ea7b92a1b249e07d3e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3c3a6b9020c01fde7b22e8550105de0b59904f61"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/d1978d03e86785872871bff9c2623174b10740de"
|
|
}
|
|
],
|
|
"title": "net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |