Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-68301— net: atlantic: fix fragment overflow handling in RX path

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于片段溢出处理不当，可能导致内核崩溃。

CVSS 9.8 · Critical EPSS 0.47% · P39

Possible ATT&CK Techniques 1 AI

T1498.002 · Reflection Amplification

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux cd66ab20a8f84474564a68fffffd37d998f6c340< 34147477eeab24077fcfe9649e282849347d760c affected
948ddbdc56636773401f2cb9c7a932eb9c43ccfd< b0c4d5135b04ea100988e2458c98f2d8564cda16 affected
6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f< 5d6051ea1b0417ae2f06a8440d22e48fbc8f8997 affected
6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f< 3be37c3c96b16462394fcb8e15e757c691377038 affected
6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f< 3fd2105e1b7e041cc24be151c9a31a14d5fc50ab affected
6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f< 64e47cd1fd631a21bf5a630cebefec6c8fc381cd affected
6aecbba12b5c90b26dc062af3b9de8c4b3a2f19f< 5ffcb7b890f61541201461580bb6622ace405aec affected
dd4fb02847e737cc38ca75e708b1a836fba45faf affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-68301

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net: atlantic: fix fragment overflow handling in RX path
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix fragment overflow handling in RX path The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This causes an out-of-bounds write in skb_add_rx_frag_netmem() leading to kernel panic. The issue occurs because the driver doesn't check the total number of fragments before calling skb_add_rx_frag(). When a packet requires more than MAX_SKB_FRAGS fragments, the fragment index exceeds the array bounds. Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE, then all fragments are accounted for. And reusing the existing check to prevent the overflow earlier in the code path. This crash occurred in production with an Aquantia AQC113 10G NIC. Stack trace from production environment: ``` RIP: 0010:skb_add_rx_frag_netmem+0x29/0xd0 Code: 90 f3 0f 1e fa 0f 1f 44 00 00 48 89 f8 41 89 ca 48 89 d7 48 63 ce 8b 90 c0 00 00 00 48 c1 e1 04 48 01 ca 48 03 90 c8 00 00 00 <48> 89 7a 30 44 89 52 3c 44 89 42 38 40 f6 c7 01 75 74 48 89 fa 83 RSP: 0018:ffffa9bec02a8d50 EFLAGS: 00010287 RAX: ffff925b22e80a00 RBX: ffff925ad38d2700 RCX: fffffffe0a0c8000 RDX: ffff9258ea95bac0 RSI: ffff925ae0a0c800 RDI: 0000000000037a40 RBP: 0000000000000024 R08: 0000000000000000 R09: 0000000000000021 R10: 0000000000000848 R11: 0000000000000000 R12: ffffa9bec02a8e24 R13: ffff925ad8615570 R14: 0000000000000000 R15: ffff925b22e80a00 FS: 0000000000000000(0000) GS:ffff925e47880000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff9258ea95baf0 CR3: 0000000166022004 CR4: 0000000000f72ef0 PKRU: 55555554 Call Trace: <IRQ> aq_ring_rx_clean+0x175/0xe60 [atlantic] ? aq_ring_rx_clean+0x14d/0xe60 [atlantic] ? aq_ring_tx_clean+0xdf/0x190 [atlantic] ? kmem_cache_free+0x348/0x450 ? aq_vec_poll+0x81/0x1d0 [atlantic] ? __napi_poll+0x28/0x1c0 ? net_rx_action+0x337/0x420 ``` Changes in v4: - Add Fixes: tag to satisfy patch validation requirements. Changes in v3: - Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE, then all fragments are accounted for.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于片段溢出处理不当，可能导致内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux cd66ab20a8f84474564a68fffffd37d998f6c340 ~ 34147477eeab24077fcfe9649e282849347d760c -
Linux Linux 5.18 -

II. Public POCs for CVE-2025-68301

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-68301

请登录查看更多情报信息。

Other References for CVE-2025-68301 (7)

Same Patch Batch · Linux · 2025-12-16 · 156 CVEs total

CVE-2025-68284 9.8 CRITICAL libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
CVE-2025-68263 9.8 CRITICAL ksmbd: ipc: fix use-after-free in ipc_msg_send_request
CVE-2025-40350 9.8 CRITICAL net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ
CVE-2025-68285 9.8 CRITICAL libceph: fix potential use-after-free in have_mon_and_osd_map()
CVE-2025-68192 9.8 CRITICAL net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
CVE-2025-68315 9.8 CRITICAL f2fs: fix to detect potential corrupted nid in free_nid_list
CVE-2025-68226 8.8 HIGH smb: client: fix incomplete backport in cfids_invalidation_worker()
CVE-2025-68304 8.8 HIGH Bluetooth: hci_core: lookup hci_conn on RX path on protocol side
CVE-2025-68255 8.8 HIGH staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
CVE-2025-68256 8.8 HIGH staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
CVE-2025-40362 8.8 HIGH ceph: fix multifs mds auth caps issue
CVE-2025-68314 8.8 HIGH drm/msm: make sure last_fence is always updated
CVE-2025-68250 8.2 HIGH hung_task: fix warnings caused by unaligned lock pointers
CVE-2025-68181 7.8 HIGH drm/radeon: Remove calls to drm_put_dev()
CVE-2025-68174 7.8 HIGH amd/amdkfd: enhance kfd process check in switch partition
CVE-2025-68175 7.8 HIGH media: nxp: imx8-isi: Fix streaming cleanup on release
CVE-2025-68260 7.8 HIGH rust_binder: fix race condition on death_list
CVE-2025-68189 7.8 HIGH drm/msm: Fix GEM free for imported dma-bufs
CVE-2025-68303 7.8 HIGH platform/x86: intel: punit_ipc: fix memory corruption
CVE-2025-68183 7.8 HIGH ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

Showing top 20 of 156 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-68301

No comments yet

Leave a comment