Linux Kernel CVE-2026-43031

The Xilinx AXI Ethernet driver in the Linux kernel implements scatter-gather DMA using multiple buffer descriptors (BDs) per packet. The Byte Queue Limits (BQL) subsystem tracks in-flight TX bytes to prevent queue bloat. The axienet_free_tx_chain function accumulates transmitted byte counts from BD status fields, but this accumulator resets on each NAPI polling cycle. When a multi-BD packet's descriptors complete across different poll invocations, only the bytes from the final poll are credited via netdev_completed_queue, while earlier BDs' bytes are lost. This creates a permanent accounting mismatch: netdev_sent_queue debits the full skb->len, but netdev_completed_queue only credits partial bytes. BQL interprets this as perpetually in-flight data and eventually stops the queue via __netdev_tx_sent_queue logic. The fix stores SKB pointers only on the last BD and uses skb->len for the complete byte count, ensuring atomic per-packet accounting immune to poll boundaries. Affected CPE indicates all Linux kernel versions with commits descending from c900e49d58eb until patches 3c3a6b9020c0 (stable), d1978d03e867 (stable), and 2a0323a91310 (mainline).