CVE-2025-68301 (GCVE-0-2025-68301)
Vulnerability from cvelistv5
Published
2025-12-16 15:06
Modified
2025-12-16 15:06
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix fragment overflow handling in RX path The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This causes an out-of-bounds write in skb_add_rx_frag_netmem() leading to kernel panic. The issue occurs because the driver doesn't check the total number of fragments before calling skb_add_rx_frag(). When a packet requires more than MAX_SKB_FRAGS fragments, the fragment index exceeds the array bounds. Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE, then all fragments are accounted for. And reusing the existing check to prevent the overflow earlier in the code path. This crash occurred in production with an Aquantia AQC113 10G NIC. Stack trace from production environment: ``` RIP: 0010:skb_add_rx_frag_netmem+0x29/0xd0 Code: 90 f3 0f 1e fa 0f 1f 44 00 00 48 89 f8 41 89 ca 48 89 d7 48 63 ce 8b 90 c0 00 00 00 48 c1 e1 04 48 01 ca 48 03 90 c8 00 00 00 <48> 89 7a 30 44 89 52 3c 44 89 42 38 40 f6 c7 01 75 74 48 89 fa 83 RSP: 0018:ffffa9bec02a8d50 EFLAGS: 00010287 RAX: ffff925b22e80a00 RBX: ffff925ad38d2700 RCX: fffffffe0a0c8000 RDX: ffff9258ea95bac0 RSI: ffff925ae0a0c800 RDI: 0000000000037a40 RBP: 0000000000000024 R08: 0000000000000000 R09: 0000000000000021 R10: 0000000000000848 R11: 0000000000000000 R12: ffffa9bec02a8e24 R13: ffff925ad8615570 R14: 0000000000000000 R15: ffff925b22e80a00 FS: 0000000000000000(0000) GS:ffff925e47880000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff9258ea95baf0 CR3: 0000000166022004 CR4: 0000000000f72ef0 PKRU: 55555554 Call Trace: <IRQ> aq_ring_rx_clean+0x175/0xe60 [atlantic] ? aq_ring_rx_clean+0x14d/0xe60 [atlantic] ? aq_ring_tx_clean+0xdf/0x190 [atlantic] ? kmem_cache_free+0x348/0x450 ? aq_vec_poll+0x81/0x1d0 [atlantic] ? __napi_poll+0x28/0x1c0 ? net_rx_action+0x337/0x420 ``` Changes in v4: - Add Fixes: tag to satisfy patch validation requirements. Changes in v3: - Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE, then all fragments are accounted for.
References
Impacted products
Vendor Product Version
Linux Linux Version: cd66ab20a8f84474564a68fffffd37d998f6c340
Version: 948ddbdc56636773401f2cb9c7a932eb9c43ccfd
Version: 6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f
Version: 6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f
Version: 6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f
Version: 6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f
Version: 6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f
Version: dd4fb02847e737cc38ca75e708b1a836fba45faf
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/aquantia/atlantic/aq_ring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "34147477eeab24077fcfe9649e282849347d760c",
              "status": "affected",
              "version": "cd66ab20a8f84474564a68fffffd37d998f6c340",
              "versionType": "git"
            },
            {
              "lessThan": "b0c4d5135b04ea100988e2458c98f2d8564cda16",
              "status": "affected",
              "version": "948ddbdc56636773401f2cb9c7a932eb9c43ccfd",
              "versionType": "git"
            },
            {
              "lessThan": "5d6051ea1b0417ae2f06a8440d22e48fbc8f8997",
              "status": "affected",
              "version": "6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f",
              "versionType": "git"
            },
            {
              "lessThan": "3be37c3c96b16462394fcb8e15e757c691377038",
              "status": "affected",
              "version": "6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f",
              "versionType": "git"
            },
            {
              "lessThan": "3fd2105e1b7e041cc24be151c9a31a14d5fc50ab",
              "status": "affected",
              "version": "6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f",
              "versionType": "git"
            },
            {
              "lessThan": "64e47cd1fd631a21bf5a630cebefec6c8fc381cd",
              "status": "affected",
              "version": "6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f",
              "versionType": "git"
            },
            {
              "lessThan": "5ffcb7b890f61541201461580bb6622ace405aec",
              "status": "affected",
              "version": "6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dd4fb02847e737cc38ca75e708b1a836fba45faf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/aquantia/atlantic/aq_ring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.119",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.247",
                  "versionStartIncluding": "5.10.118",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.197",
                  "versionStartIncluding": "5.15.42",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.119",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.61",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.11",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.17.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atlantic: fix fragment overflow handling in RX path\n\nThe atlantic driver can receive packets with more than MAX_SKB_FRAGS (17)\nfragments when handling large multi-descriptor packets. This causes an\nout-of-bounds write in skb_add_rx_frag_netmem() leading to kernel panic.\n\nThe issue occurs because the driver doesn\u0027t check the total number of\nfragments before calling skb_add_rx_frag(). When a packet requires more\nthan MAX_SKB_FRAGS fragments, the fragment index exceeds the array bounds.\n\nFix by assuming there will be an extra frag if buff-\u003elen \u003e AQ_CFG_RX_HDR_SIZE,\nthen all fragments are accounted for. And reusing the existing check to\nprevent the overflow earlier in the code path.\n\nThis crash occurred in production with an Aquantia AQC113 10G NIC.\n\nStack trace from production environment:\n```\nRIP: 0010:skb_add_rx_frag_netmem+0x29/0xd0\nCode: 90 f3 0f 1e fa 0f 1f 44 00 00 48 89 f8 41 89\nca 48 89 d7 48 63 ce 8b 90 c0 00 00 00 48 c1 e1 04 48 01 ca 48 03 90\nc8 00 00 00 \u003c48\u003e 89 7a 30 44 89 52 3c 44 89 42 38 40 f6 c7 01 75 74 48\n89 fa 83\nRSP: 0018:ffffa9bec02a8d50 EFLAGS: 00010287\nRAX: ffff925b22e80a00 RBX: ffff925ad38d2700 RCX:\nfffffffe0a0c8000\nRDX: ffff9258ea95bac0 RSI: ffff925ae0a0c800 RDI:\n0000000000037a40\nRBP: 0000000000000024 R08: 0000000000000000 R09:\n0000000000000021\nR10: 0000000000000848 R11: 0000000000000000 R12:\nffffa9bec02a8e24\nR13: ffff925ad8615570 R14: 0000000000000000 R15:\nffff925b22e80a00\nFS: 0000000000000000(0000)\nGS:ffff925e47880000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffff9258ea95baf0 CR3: 0000000166022004 CR4:\n0000000000f72ef0\nPKRU: 55555554\nCall Trace:\n\u003cIRQ\u003e\naq_ring_rx_clean+0x175/0xe60 [atlantic]\n? aq_ring_rx_clean+0x14d/0xe60 [atlantic]\n? aq_ring_tx_clean+0xdf/0x190 [atlantic]\n? kmem_cache_free+0x348/0x450\n? aq_vec_poll+0x81/0x1d0 [atlantic]\n? __napi_poll+0x28/0x1c0\n? net_rx_action+0x337/0x420\n```\n\nChanges in v4:\n- Add Fixes: tag to satisfy patch validation requirements.\n\nChanges in v3:\n- Fix by assuming there will be an extra frag if buff-\u003elen \u003e AQ_CFG_RX_HDR_SIZE,\n  then all fragments are accounted for."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-16T15:06:19.688Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/34147477eeab24077fcfe9649e282849347d760c"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0c4d5135b04ea100988e2458c98f2d8564cda16"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d6051ea1b0417ae2f06a8440d22e48fbc8f8997"
        },
        {
          "url": "https://git.kernel.org/stable/c/3be37c3c96b16462394fcb8e15e757c691377038"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fd2105e1b7e041cc24be151c9a31a14d5fc50ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/64e47cd1fd631a21bf5a630cebefec6c8fc381cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ffcb7b890f61541201461580bb6622ace405aec"
        }
      ],
      "title": "net: atlantic: fix fragment overflow handling in RX path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68301",
    "datePublished": "2025-12-16T15:06:19.688Z",
    "dateReserved": "2025-12-16T14:48:05.293Z",
    "dateUpdated": "2025-12-16T15:06:19.688Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68301\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-16T16:16:09.617\",\"lastModified\":\"2025-12-18T15:08:06.237\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: atlantic: fix fragment overflow handling in RX path\\n\\nThe atlantic driver can receive packets with more than MAX_SKB_FRAGS (17)\\nfragments when handling large multi-descriptor packets. This causes an\\nout-of-bounds write in skb_add_rx_frag_netmem() leading to kernel panic.\\n\\nThe issue occurs because the driver doesn\u0027t check the total number of\\nfragments before calling skb_add_rx_frag(). When a packet requires more\\nthan MAX_SKB_FRAGS fragments, the fragment index exceeds the array bounds.\\n\\nFix by assuming there will be an extra frag if buff-\u003elen \u003e AQ_CFG_RX_HDR_SIZE,\\nthen all fragments are accounted for. And reusing the existing check to\\nprevent the overflow earlier in the code path.\\n\\nThis crash occurred in production with an Aquantia AQC113 10G NIC.\\n\\nStack trace from production environment:\\n```\\nRIP: 0010:skb_add_rx_frag_netmem+0x29/0xd0\\nCode: 90 f3 0f 1e fa 0f 1f 44 00 00 48 89 f8 41 89\\nca 48 89 d7 48 63 ce 8b 90 c0 00 00 00 48 c1 e1 04 48 01 ca 48 03 90\\nc8 00 00 00 \u003c48\u003e 89 7a 30 44 89 52 3c 44 89 42 38 40 f6 c7 01 75 74 48\\n89 fa 83\\nRSP: 0018:ffffa9bec02a8d50 EFLAGS: 00010287\\nRAX: ffff925b22e80a00 RBX: ffff925ad38d2700 RCX:\\nfffffffe0a0c8000\\nRDX: ffff9258ea95bac0 RSI: ffff925ae0a0c800 RDI:\\n0000000000037a40\\nRBP: 0000000000000024 R08: 0000000000000000 R09:\\n0000000000000021\\nR10: 0000000000000848 R11: 0000000000000000 R12:\\nffffa9bec02a8e24\\nR13: ffff925ad8615570 R14: 0000000000000000 R15:\\nffff925b22e80a00\\nFS: 0000000000000000(0000)\\nGS:ffff925e47880000(0000) knlGS:0000000000000000\\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: ffff9258ea95baf0 CR3: 0000000166022004 CR4:\\n0000000000f72ef0\\nPKRU: 55555554\\nCall Trace:\\n\u003cIRQ\u003e\\naq_ring_rx_clean+0x175/0xe60 [atlantic]\\n? aq_ring_rx_clean+0x14d/0xe60 [atlantic]\\n? aq_ring_tx_clean+0xdf/0x190 [atlantic]\\n? kmem_cache_free+0x348/0x450\\n? aq_vec_poll+0x81/0x1d0 [atlantic]\\n? __napi_poll+0x28/0x1c0\\n? net_rx_action+0x337/0x420\\n```\\n\\nChanges in v4:\\n- Add Fixes: tag to satisfy patch validation requirements.\\n\\nChanges in v3:\\n- Fix by assuming there will be an extra frag if buff-\u003elen \u003e AQ_CFG_RX_HDR_SIZE,\\n  then all fragments are accounted for.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/34147477eeab24077fcfe9649e282849347d760c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3be37c3c96b16462394fcb8e15e757c691377038\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3fd2105e1b7e041cc24be151c9a31a14d5fc50ab\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5d6051ea1b0417ae2f06a8440d22e48fbc8f8997\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5ffcb7b890f61541201461580bb6622ace405aec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/64e47cd1fd631a21bf5a630cebefec6c8fc381cd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b0c4d5135b04ea100988e2458c98f2d8564cda16\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.