Executive brief
A vulnerability in the Linux kernel's Atlantic network driver could allow a remote attacker to crash the system. The issue occurs when the driver processes specially crafted, large network packets that exceed internal memory limits. This can lead to a kernel panic, resulting in a complete system outage.
Technical details
An out-of-bounds write vulnerability exists in the Atlantic (Aquantia) network driver's RX path within the Linux kernel. The driver fails to properly validate the number of fragments in multi-descriptor packets before calling skb_add_rx_frag(), allowing the fragment index to exceed the MAX_SKB_FRAGS limit. This results in an out-of-bounds write in skb_add_rx_frag_netmem(), leading to a kernel panic. The vulnerability can be triggered by receiving large packets over the network. Patches have been released for various stable kernel branches to ensure all fragments are accounted for before processing.
Affected products
- Linux Linux Kernel 6aecbba12b5c to 5ffcb7b890f6
Timeline
- 2025-11-26: patched: Initial patch submitted
- 2025-12-16: advisory: CVE-2025-68301 published
References
- https://git.kernel.org/stable/c/34147477eeab24077fcfe9649e282849347d760c
- https://git.kernel.org/stable/c/3be37c3c96b16462394fcb8e15e757c691377038
- https://git.kernel.org/stable/c/3fd2105e1b7e041cc24be151c9a31a14d5fc50ab
- https://git.kernel.org/stable/c/5d6051ea1b0417ae2f06a8440d22e48fbc8f8997
- https://git.kernel.org/stable/c/5ffcb7b890f61541201461580bb6622ace405aec
- https://git.kernel.org/stable/c/64e47cd1fd631a21bf5a630cebefec6c8fc381cd
- https://git.kernel.org/stable/c/b0c4d5135b04ea100988e2458c98f2d8564cda16