Improper control of a resource through its lifetime in Linux kernel - CVE-2026-43031

Detailed vulnerability description

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource accounting in axienet_free_tx_chain when processing transmit completions for scatter-gather packets across multiple NAPI polls. A local user can trigger transmission of packets that span multiple buffer descriptors to cause a denial of service.

The issue occurs because the SKB pointer is stored only on the last buffer descriptor of a packet, so partial completion across different polls can leave bytes permanently accounted as in-flight and stall the transmit queue.

How to mitigate CVE-2026-43031

Sources

• https://git.kernel.org/stable/c/2a0323a913109b52bfc9f5ea7b92a1b249e07d3e
• https://git.kernel.org/stable/c/3c3a6b9020c01fde7b22e8550105de0b59904f61
• https://git.kernel.org/stable/c/d1978d03e86785872871bff9c2623174b10740de