CVE-2025-68301 (GCVE-0-2025-68301)

Vulnerability from cvelistv5 – Published: 2025-12-16 15:06 – Updated: 2025-12-16 15:06
VLAI?
Title
net: atlantic: fix fragment overflow handling in RX path
Summary
In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix fragment overflow handling in RX path The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This causes an out-of-bounds write in skb_add_rx_frag_netmem() leading to kernel panic. The issue occurs because the driver doesn't check the total number of fragments before calling skb_add_rx_frag(). When a packet requires more than MAX_SKB_FRAGS fragments, the fragment index exceeds the array bounds. Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE, then all fragments are accounted for. And reusing the existing check to prevent the overflow earlier in the code path. This crash occurred in production with an Aquantia AQC113 10G NIC. Stack trace from production environment: ``` RIP: 0010:skb_add_rx_frag_netmem+0x29/0xd0 Code: 90 f3 0f 1e fa 0f 1f 44 00 00 48 89 f8 41 89 ca 48 89 d7 48 63 ce 8b 90 c0 00 00 00 48 c1 e1 04 48 01 ca 48 03 90 c8 00 00 00 <48> 89 7a 30 44 89 52 3c 44 89 42 38 40 f6 c7 01 75 74 48 89 fa 83 RSP: 0018:ffffa9bec02a8d50 EFLAGS: 00010287 RAX: ffff925b22e80a00 RBX: ffff925ad38d2700 RCX: fffffffe0a0c8000 RDX: ffff9258ea95bac0 RSI: ffff925ae0a0c800 RDI: 0000000000037a40 RBP: 0000000000000024 R08: 0000000000000000 R09: 0000000000000021 R10: 0000000000000848 R11: 0000000000000000 R12: ffffa9bec02a8e24 R13: ffff925ad8615570 R14: 0000000000000000 R15: ffff925b22e80a00 FS: 0000000000000000(0000) GS:ffff925e47880000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff9258ea95baf0 CR3: 0000000166022004 CR4: 0000000000f72ef0 PKRU: 55555554 Call Trace: <IRQ> aq_ring_rx_clean+0x175/0xe60 [atlantic] ? aq_ring_rx_clean+0x14d/0xe60 [atlantic] ? aq_ring_tx_clean+0xdf/0x190 [atlantic] ? kmem_cache_free+0x348/0x450 ? aq_vec_poll+0x81/0x1d0 [atlantic] ? __napi_poll+0x28/0x1c0 ? net_rx_action+0x337/0x420 ``` Changes in v4: - Add Fixes: tag to satisfy patch validation requirements. Changes in v3: - Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE, then all fragments are accounted for.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: cd66ab20a8f84474564a68fffffd37d998f6c340 , < 34147477eeab24077fcfe9649e282849347d760c (git)
Affected: 948ddbdc56636773401f2cb9c7a932eb9c43ccfd , < b0c4d5135b04ea100988e2458c98f2d8564cda16 (git)
Affected: 6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f , < 5d6051ea1b0417ae2f06a8440d22e48fbc8f8997 (git)
Affected: 6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f , < 3be37c3c96b16462394fcb8e15e757c691377038 (git)
Affected: 6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f , < 3fd2105e1b7e041cc24be151c9a31a14d5fc50ab (git)
Affected: 6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f , < 64e47cd1fd631a21bf5a630cebefec6c8fc381cd (git)
Affected: 6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f , < 5ffcb7b890f61541201461580bb6622ace405aec (git)
Affected: dd4fb02847e737cc38ca75e708b1a836fba45faf (git)
Create a notification for this product.
    Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 5.10.247 , ≤ 5.10.* (semver)
Unaffected: 5.15.197 , ≤ 5.15.* (semver)
Unaffected: 6.1.159 , ≤ 6.1.* (semver)
Unaffected: 6.6.119 , ≤ 6.6.* (semver)
Unaffected: 6.12.61 , ≤ 6.12.* (semver)
Unaffected: 6.17.11 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/aquantia/atlantic/aq_ring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "34147477eeab24077fcfe9649e282849347d760c",
              "status": "affected",
              "version": "cd66ab20a8f84474564a68fffffd37d998f6c340",
              "versionType": "git"
            },
            {
              "lessThan": "b0c4d5135b04ea100988e2458c98f2d8564cda16",
              "status": "affected",
              "version": "948ddbdc56636773401f2cb9c7a932eb9c43ccfd",
              "versionType": "git"
            },
            {
              "lessThan": "5d6051ea1b0417ae2f06a8440d22e48fbc8f8997",
              "status": "affected",
              "version": "6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f",
              "versionType": "git"
            },
            {
              "lessThan": "3be37c3c96b16462394fcb8e15e757c691377038",
              "status": "affected",
              "version": "6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f",
              "versionType": "git"
            },
            {
              "lessThan": "3fd2105e1b7e041cc24be151c9a31a14d5fc50ab",
              "status": "affected",
              "version": "6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f",
              "versionType": "git"
            },
            {
              "lessThan": "64e47cd1fd631a21bf5a630cebefec6c8fc381cd",
              "status": "affected",
              "version": "6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f",
              "versionType": "git"
            },
            {
              "lessThan": "5ffcb7b890f61541201461580bb6622ace405aec",
              "status": "affected",
              "version": "6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dd4fb02847e737cc38ca75e708b1a836fba45faf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/aquantia/atlantic/aq_ring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.119",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.247",
                  "versionStartIncluding": "5.10.118",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.197",
                  "versionStartIncluding": "5.15.42",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.119",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.61",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.11",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.17.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atlantic: fix fragment overflow handling in RX path\n\nThe atlantic driver can receive packets with more than MAX_SKB_FRAGS (17)\nfragments when handling large multi-descriptor packets. This causes an\nout-of-bounds write in skb_add_rx_frag_netmem() leading to kernel panic.\n\nThe issue occurs because the driver doesn\u0027t check the total number of\nfragments before calling skb_add_rx_frag(). When a packet requires more\nthan MAX_SKB_FRAGS fragments, the fragment index exceeds the array bounds.\n\nFix by assuming there will be an extra frag if buff-\u003elen \u003e AQ_CFG_RX_HDR_SIZE,\nthen all fragments are accounted for. And reusing the existing check to\nprevent the overflow earlier in the code path.\n\nThis crash occurred in production with an Aquantia AQC113 10G NIC.\n\nStack trace from production environment:\n```\nRIP: 0010:skb_add_rx_frag_netmem+0x29/0xd0\nCode: 90 f3 0f 1e fa 0f 1f 44 00 00 48 89 f8 41 89\nca 48 89 d7 48 63 ce 8b 90 c0 00 00 00 48 c1 e1 04 48 01 ca 48 03 90\nc8 00 00 00 \u003c48\u003e 89 7a 30 44 89 52 3c 44 89 42 38 40 f6 c7 01 75 74 48\n89 fa 83\nRSP: 0018:ffffa9bec02a8d50 EFLAGS: 00010287\nRAX: ffff925b22e80a00 RBX: ffff925ad38d2700 RCX:\nfffffffe0a0c8000\nRDX: ffff9258ea95bac0 RSI: ffff925ae0a0c800 RDI:\n0000000000037a40\nRBP: 0000000000000024 R08: 0000000000000000 R09:\n0000000000000021\nR10: 0000000000000848 R11: 0000000000000000 R12:\nffffa9bec02a8e24\nR13: ffff925ad8615570 R14: 0000000000000000 R15:\nffff925b22e80a00\nFS: 0000000000000000(0000)\nGS:ffff925e47880000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffff9258ea95baf0 CR3: 0000000166022004 CR4:\n0000000000f72ef0\nPKRU: 55555554\nCall Trace:\n\u003cIRQ\u003e\naq_ring_rx_clean+0x175/0xe60 [atlantic]\n? aq_ring_rx_clean+0x14d/0xe60 [atlantic]\n? aq_ring_tx_clean+0xdf/0x190 [atlantic]\n? kmem_cache_free+0x348/0x450\n? aq_vec_poll+0x81/0x1d0 [atlantic]\n? __napi_poll+0x28/0x1c0\n? net_rx_action+0x337/0x420\n```\n\nChanges in v4:\n- Add Fixes: tag to satisfy patch validation requirements.\n\nChanges in v3:\n- Fix by assuming there will be an extra frag if buff-\u003elen \u003e AQ_CFG_RX_HDR_SIZE,\n  then all fragments are accounted for."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-16T15:06:19.688Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/34147477eeab24077fcfe9649e282849347d760c"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0c4d5135b04ea100988e2458c98f2d8564cda16"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d6051ea1b0417ae2f06a8440d22e48fbc8f8997"
        },
        {
          "url": "https://git.kernel.org/stable/c/3be37c3c96b16462394fcb8e15e757c691377038"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fd2105e1b7e041cc24be151c9a31a14d5fc50ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/64e47cd1fd631a21bf5a630cebefec6c8fc381cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ffcb7b890f61541201461580bb6622ace405aec"
        }
      ],
      "title": "net: atlantic: fix fragment overflow handling in RX path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68301",
    "datePublished": "2025-12-16T15:06:19.688Z",
    "dateReserved": "2025-12-16T14:48:05.293Z",
    "dateUpdated": "2025-12-16T15:06:19.688Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68301\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-16T16:16:09.617\",\"lastModified\":\"2025-12-18T15:08:06.237\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: atlantic: fix fragment overflow handling in RX path\\n\\nThe atlantic driver can receive packets with more than MAX_SKB_FRAGS (17)\\nfragments when handling large multi-descriptor packets. This causes an\\nout-of-bounds write in skb_add_rx_frag_netmem() leading to kernel panic.\\n\\nThe issue occurs because the driver doesn\u0027t check the total number of\\nfragments before calling skb_add_rx_frag(). When a packet requires more\\nthan MAX_SKB_FRAGS fragments, the fragment index exceeds the array bounds.\\n\\nFix by assuming there will be an extra frag if buff-\u003elen \u003e AQ_CFG_RX_HDR_SIZE,\\nthen all fragments are accounted for. And reusing the existing check to\\nprevent the overflow earlier in the code path.\\n\\nThis crash occurred in production with an Aquantia AQC113 10G NIC.\\n\\nStack trace from production environment:\\n```\\nRIP: 0010:skb_add_rx_frag_netmem+0x29/0xd0\\nCode: 90 f3 0f 1e fa 0f 1f 44 00 00 48 89 f8 41 89\\nca 48 89 d7 48 63 ce 8b 90 c0 00 00 00 48 c1 e1 04 48 01 ca 48 03 90\\nc8 00 00 00 \u003c48\u003e 89 7a 30 44 89 52 3c 44 89 42 38 40 f6 c7 01 75 74 48\\n89 fa 83\\nRSP: 0018:ffffa9bec02a8d50 EFLAGS: 00010287\\nRAX: ffff925b22e80a00 RBX: ffff925ad38d2700 RCX:\\nfffffffe0a0c8000\\nRDX: ffff9258ea95bac0 RSI: ffff925ae0a0c800 RDI:\\n0000000000037a40\\nRBP: 0000000000000024 R08: 0000000000000000 R09:\\n0000000000000021\\nR10: 0000000000000848 R11: 0000000000000000 R12:\\nffffa9bec02a8e24\\nR13: ffff925ad8615570 R14: 0000000000000000 R15:\\nffff925b22e80a00\\nFS: 0000000000000000(0000)\\nGS:ffff925e47880000(0000) knlGS:0000000000000000\\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: ffff9258ea95baf0 CR3: 0000000166022004 CR4:\\n0000000000f72ef0\\nPKRU: 55555554\\nCall Trace:\\n\u003cIRQ\u003e\\naq_ring_rx_clean+0x175/0xe60 [atlantic]\\n? aq_ring_rx_clean+0x14d/0xe60 [atlantic]\\n? aq_ring_tx_clean+0xdf/0x190 [atlantic]\\n? kmem_cache_free+0x348/0x450\\n? aq_vec_poll+0x81/0x1d0 [atlantic]\\n? __napi_poll+0x28/0x1c0\\n? net_rx_action+0x337/0x420\\n```\\n\\nChanges in v4:\\n- Add Fixes: tag to satisfy patch validation requirements.\\n\\nChanges in v3:\\n- Fix by assuming there will be an extra frag if buff-\u003elen \u003e AQ_CFG_RX_HDR_SIZE,\\n  then all fragments are accounted for.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/34147477eeab24077fcfe9649e282849347d760c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3be37c3c96b16462394fcb8e15e757c691377038\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3fd2105e1b7e041cc24be151c9a31a14d5fc50ab\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5d6051ea1b0417ae2f06a8440d22e48fbc8f8997\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5ffcb7b890f61541201461580bb6622ace405aec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/64e47cd1fd631a21bf5a630cebefec6c8fc381cd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b0c4d5135b04ea100988e2458c98f2d8564cda16\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.