CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path

Published Dec 16, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

net: atlantic: fix fragment overflow handling in RX path

The atlantic driver can receive packets with more than MAXSKBFRAGS (17) fragments when handling large multi-descriptor packets. This causes an out-of-bounds write in skbaddrxfragnetmem() leading to kernel panic.

The issue occurs because the driver doesn't check the total number of fragments before calling skbaddrxfrag(). When a packet requires more than MAXSKBFRAGS fragments, the fragment index exceeds the array bounds.

Fix by assuming there will be an extra frag if buff->len > AQCFGRXHDRSIZE, then all fragments are accounted for. And reusing the existing check to prevent the overflow earlier in the code path.

This crash occurred in production with an Aquantia AQC113 10G NIC.

Stack trace from production environment: RIP: 0010:skbaddrxfragnetmem+0x29/0xd0 Code: 90 f3 0f 1e fa 0f 1f 44 00 00 48 89 f8 41 89 ca 48 89 d7 48 63 ce 8b 90 c0 00 00 00 48 c1 e1 04 48 01 ca 48 03 90 c8 00 00 00 <48> 89 7a 30 44 89 52 3c 44 89 42 38 40 f6 c7 01 75 74 48 89 fa 83 RSP: 0018:ffffa9bec02a8d50 EFLAGS: 00010287 RAX: ffff925b22e80a00 RBX: ffff925ad38d2700 RCX: fffffffe0a0c8000 RDX: ffff9258ea95bac0 RSI: ffff925ae0a0c800 RDI: 0000000000037a40 RBP: 0000000000000024 R08: 0000000000000000 R09: 0000000000000021 R10: 0000000000000848 R11: 0000000000000000 R12: ffffa9bec02a8e24 R13: ffff925ad8615570 R14: 0000000000000000 R15: ffff925b22e80a00 FS: 0000000000000000(0000) GS:ffff925e47880000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff9258ea95baf0 CR3: 0000000166022004 CR4: 0000000000f72ef0 PKRU: 55555554 Call Trace: <IRQ> aqringrxclean+0x175/0xe60 [atlantic] ? aqringrxclean+0x14d/0xe60 [atlantic] ? aqringtxclean+0xdf/0x190 [atlantic] ? kmemcachefree+0x348/0x450 ? aqvecpoll+0x81/0x1d0 [atlantic] ? napipoll+0x28/0x1c0 ? netrxaction+0x337/0x420

Changes in v4: - Add Fixes: tag to satisfy patch validation requirements.

Changes in v3: - Fix by assuming there will be an extra frag if buff->len > AQCFGRXHDRSIZE, then all fragments are accounted for.

Other sources

In the Linux kernel, the following vulnerability has been resolved:

net: atlantic: fix fragment overflow handling in RX path

The atlantic driver can receive packets with more than MAXSKBFRAGS (17) fragments when handling large multi-descriptor packets. This causes an out-of-bounds write in skbaddrxfragnetmem() leading to kernel panic.

The issue occurs because the driver doesn't check the total number of fragments before calling skbaddrxfrag(). When a packet requires more than MAXSKBFRAGS fragments, the fragment index exceeds the array bounds.

Fix by assuming there will be an extra frag if buff-len AQCFGRXHDRSIZE, then all fragments are accounted for. And reusing the existing check to prevent the overflow earlier in the code path.

This crash occurred in production with an Aquantia AQC113 10G NIC.

Stack trace from production environment: RIP: 0010:skbaddrxfragnetmem+0x29/0xd0 Code: 90 f3 0f 1e fa 0f 1f 44 00 00 48 89 f8 41 89 ca 48 89 d7 48 63 ce 8b 90 c0 00 00 00 48 c1 e1 04 48 01 ca 48 03 90 c8 00 00 00 48 89 7a 30 44 89 52 3c 44 89 42 38 40 f6 c7 01 75 74 48 89 fa 83 RSP: 0018:ffffa9bec02a8d50 EFLAGS: 00010287 RAX: ffff925b22e80a00 RBX: ffff925ad38d2700 RCX: fffffffe0a0c8000 RDX: ffff9258ea95bac0 RSI: ffff925ae0a0c800 RDI: 0000000000037a40 RBP: 0000000000000024 R08: 0000000000000000 R09: 0000000000000021 R10: 0000000000000848 R11: 0000000000000000 R12: ffffa9bec02a8e24 R13: ffff925ad8615570 R14: 0000000000000000 R15: ffff925b22e80a00 FS: 0000000000000000(0000) GS:ffff925e47880000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff9258ea95baf0 CR3: 0000000166022004 CR4: 0000000000f72ef0 PKRU: 55555554 Call Trace: IRQ aqringrxclean+0x175/0xe60 [atlantic] ? aqringrxclean+0x14d/0xe60 [atlantic] ? aqringtxclean+0xdf/0x190 [atlantic] ? kmemcachefree+0x348/0x450 ? aqvecpoll+0x81/0x1d0 [atlantic] ? napipoll+0x28/0x1c0 ? netrxaction+0x337/0x420

Changes in v4: - Add Fixes: tag to satisfy patch validation requirements.

Changes in v3: - Fix by assuming there will be an extra frag if buff-len AQCFGRXHDRSIZE, then all fragments are accounted for.

— IBM

Affected Software

194 affected componentsFixes available
Linux Linux kernel
Microsoft azl3 kernel 6.6.117.1-1
Patch available
IBM Verify Identity Access<=11.0 - 11.0.2
IBM Security Verify Access<=10.0 - 10.0.9.1
IBM Verify Identity Access Container<=11.0 - 11.0.2
IBM Security Verify Access Container<=10.0 - 10.0.9.1
ubuntu/linux-hwe-edge*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.15<5.15.0-1103.110~20.04.1
5.15.0-1103.110~20.04.1
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.15<5.15.0-1110.119~20.04.1
5.15.0-1110.119~20.04.1
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.15<5.15.0-1103.112~20.04.1
5.15.0-1103.112~20.04.1
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.15<5.15.0-173.183~20.04.1
5.15.0-173.183~20.04.1
ubuntu/linux-hwe-5.8*
ubuntu/linux-ibm-5.15<5.15.0-1097.100~20.04.1
5.15.0-1097.100~20.04.1
ubuntu/linux-intel-5.13*
ubuntu/linux-intel-iotg-5.15<5.15.0-1098.104~20.04.1
5.15.0-1098.104~20.04.1
ubuntu/linux-lowlatency-hwe-5.15<5.15.0-173.183~20.04.1
5.15.0-173.183~20.04.1
ubuntu/linux-nvidia-tegra-5.15<5.15.0-1055.55~20.04.1
5.15.0-1055.55~20.04.1
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.15<5.15.0-1100.106~20.04.1
5.15.0-1100.106~20.04.1
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.15<5.15.0-1097.101~20.04.1
5.15.0-1097.101~20.04.1
ubuntu/linux-riscv-5.8*
ubuntu/linux<5.15.0-173.183
5.15.0-173.183
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws<5.15.0-1103.110
5.15.0-1103.110
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-aws-6.8<6.8.0-1050.53~22.04.1
6.8.0-1050.53~22.04.1
ubuntu/linux-azure<5.15.0-1109.118
5.15.0-1109.118
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-6.8<6.8.0-1051.57~22.04.1
6.8.0-1051.57~22.04.1
ubuntu/linux-azure-fde<5.15.0-1109.118.1
5.15.0-1109.118.1
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-azure-fde-6.8<6.8.0-1058.65~22.04.1
6.8.0-1058.65~22.04.1
ubuntu/linux-gcp<5.15.0-1103.112
5.15.0-1103.112
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gcp-6.8<6.8.0-1052.55~22.04.1
6.8.0-1052.55~22.04.1
ubuntu/linux-gke<5.15.0-1099.105
5.15.0-1099.105
ubuntu/linux-gkeop<5.15.0-1086.94
5.15.0-1086.94
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-hwe-6.8<6.8.0-106.106~22.04.1
6.8.0-106.106~22.04.1
ubuntu/linux-ibm<5.15.0-1097.100
5.15.0-1097.100
ubuntu/linux-ibm-6.8<6.8.0-1049.49~22.04.1
6.8.0-1049.49~22.04.1
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-intel-iotg<5.15.0-1098.104
5.15.0-1098.104
ubuntu/linux-kvm<5.15.0-1095.100
5.15.0-1095.100
ubuntu/linux-lowlatency<5.15.0-173.183
5.15.0-173.183
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-lowlatency-hwe-6.8<6.8.0-106.106.1~22.04.1
6.8.0-106.106.1~22.04.1
ubuntu/linux-nvidia<5.15.0-1098.99
5.15.0-1098.99
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-nvidia-6.8<6.8.0-1049.52~22.04.1
6.8.0-1049.52~22.04.1
ubuntu/linux-nvidia-tegra<5.15.0-1055.55
5.15.0-1055.55
ubuntu/linux-nvidia-tegra-igx<5.15.0-1044.44
5.15.0-1044.44
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle<5.15.0-1100.106
5.15.0-1100.106
ubuntu/linux-oracle-6.5*
ubuntu/linux-oracle-6.8<6.8.0-1047.48~22.04.1
6.8.0-1047.48~22.04.1
ubuntu/linux-raspi<5.15.0-1097.100
5.15.0-1097.100
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-riscv-6.8<6.8.0-106.106~22.04.1
6.8.0-106.106~22.04.1
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-xilinx-zynqmp<5.15.0-1067.71
5.15.0-1067.71
ubuntu/linux-bluefield<5.15.0-1086.88
5.15.0-1086.88
ubuntu/linux-intel-iot-realtime<5.15.0-1094.96
5.15.0-1094.96
ubuntu/linux-realtime<5.15.0-1102.111
5.15.0-1102.111
ubuntu/linux-realtime-6.8<6.8.1-1045.46~22.04.1
6.8.1-1045.46~22.04.1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-aws-fips<5.15.0-1103.110+fips1
5.15.0-1103.110+fips1
ubuntu/linux-azure-fips<5.15.0-1109.118+fips1
5.15.0-1109.118+fips1
ubuntu/linux-fips<5.15.0-173.183+fips1
5.15.0-173.183+fips1
ubuntu/linux-gcp-fips<5.15.0-1103.112+fips1
5.15.0-1103.112+fips1
ubuntu/linux<6.8.0-106.106
6.8.0-106.106
ubuntu/linux-aws<6.8.0-1050.53
6.8.0-1050.53
ubuntu/linux-aws-6.14*
ubuntu/linux-aws-6.17<6.17.0-1009.9~24.04.2
6.17.0-1009.9~24.04.2
ubuntu/linux-azure<6.8.0-1051.57
6.8.0-1051.57
ubuntu/linux-azure-6.11*
ubuntu/linux-azure-6.14*
ubuntu/linux-azure-6.17<6.17.0-1010.10~24.04.1
6.17.0-1010.10~24.04.1
ubuntu/linux-azure-fde<6.8.0-1058.65
6.8.0-1058.65
ubuntu/linux-azure-fde-6.14*
ubuntu/linux-azure-nvidia<6.8.0-1039.42
6.8.0-1039.42
ubuntu/linux-azure-nvidia-6.14*
ubuntu/linux-gcp<6.8.0-1052.55
6.8.0-1052.55
ubuntu/linux-gcp-6.11*
ubuntu/linux-gcp-6.14*
ubuntu/linux-gcp-6.17<6.17.0-1009.9~24.04.3
6.17.0-1009.9~24.04.3
ubuntu/linux-gke<6.8.0-1048.53
6.8.0-1048.53
ubuntu/linux-gkeop<6.8.0-1035.38
6.8.0-1035.38
ubuntu/linux-hwe-6.11*
ubuntu/linux-hwe-6.14*
ubuntu/linux-hwe-6.17<6.17.0-19.19~24.04.2
6.17.0-19.19~24.04.2
ubuntu/linux-ibm<6.8.0-1049.49
6.8.0-1049.49
ubuntu/linux-lowlatency<6.8.0-106.106.1
6.8.0-106.106.1
ubuntu/linux-lowlatency-hwe-6.11*
ubuntu/linux-nvidia<6.8.0-1049.52
6.8.0-1049.52
ubuntu/linux-nvidia-6.11*
ubuntu/linux-nvidia-6.17<6.17.0-1014.14
6.17.0-1014.14
ubuntu/linux-nvidia-lowlatency<6.8.0-1049.52.1
6.8.0-1049.52.1
ubuntu/linux-nvidia-tegra<6.8.0-1020.20
6.8.0-1020.20
ubuntu/linux-oem-6.11*
ubuntu/linux-oem-6.14*
ubuntu/linux-oem-6.17<6.17.0-1017.17
6.17.0-1017.17
ubuntu/linux-oem-6.8*
ubuntu/linux-oracle<6.8.0-1047.48
6.8.0-1047.48
ubuntu/linux-oracle-6.14*
ubuntu/linux-oracle-6.17<6.17.0-1009.9~24.04.1
6.17.0-1009.9~24.04.1
ubuntu/linux-raspi<6.8.0-1050.54
6.8.0-1050.54
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-6.14*
ubuntu/linux-riscv-6.17<6.17.0-19.19.1~24.04.1
6.17.0-19.19.1~24.04.1
ubuntu/linux-xilinx<6.8.0-1028.29
6.8.0-1028.29
ubuntu/linux-bluefield<6.8.0-1017.21
6.8.0-1017.21
ubuntu/linux-raspi-realtime<6.8.0-2040.41
6.8.0-2040.41
ubuntu/linux-realtime<6.8.1-1045.46
6.8.1-1045.46
ubuntu/linux-realtime-6.14*
ubuntu/linux-realtime-6.17<6.17.0-1008.9~24.04.1
6.17.0-1008.9~24.04.1
ubuntu/linux-aws-fips<6.8.0-1050.53+fips1
6.8.0-1050.53+fips1
ubuntu/linux-azure-fips<6.8.0-1052.58+fips1
6.8.0-1052.58+fips1
ubuntu/linux-fips<6.8.0-106.106+fips1
6.8.0-106.106+fips1
ubuntu/linux-gcp-fips<6.8.0-1052.55+fips1
6.8.0-1052.55+fips1
ubuntu/linux<6.17.0-19.19
6.17.0-19.19
ubuntu/linux-aws<6.17.0-1009.9
6.17.0-1009.9
ubuntu/linux-azure<6.17.0-1010.10
6.17.0-1010.10
ubuntu/linux-azure-fde*
ubuntu/linux-gcp<6.17.0-1009.9
6.17.0-1009.9
ubuntu/linux-oracle<6.17.0-1009.9
6.17.0-1009.9
ubuntu/linux-raspi<6.17.0-1010.10
6.17.0-1010.10
ubuntu/linux-realtime<6.17.0-1008.9
6.17.0-1008.9
ubuntu/linux-riscv<6.17.0-19.19.1
6.17.0-19.19.1
ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1103.110~20.04.1
  2. Upgrade

    Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1110.119~20.04.1
  3. Upgrade

    Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1103.112~20.04.1
  4. Upgrade

    Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-173.183~20.04.1
  5. Upgrade

    Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1097.100~20.04.1
  6. Upgrade

    Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1098.104~20.04.1
  7. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-173.183~20.04.1
  8. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1055.55~20.04.1
  9. Upgrade

    Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1100.106~20.04.1
  10. Upgrade

    Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1097.101~20.04.1
  11. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.15.0-173.183
  12. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.15.0-1103.110
  13. Upgrade

    Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1050.53~22.04.1
  14. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.15.0-1109.118
  15. Upgrade

    Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1051.57~22.04.1
  16. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 5.15.0-1109.118.1
  17. Upgrade

    Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1058.65~22.04.1
  18. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1103.112
  19. Upgrade

    Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1052.55~22.04.1
  20. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 5.15.0-1099.105
  21. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.15.0-1086.94
  22. Upgrade

    Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-106.106~22.04.1
  23. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1097.100
  24. Upgrade

    Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1049.49~22.04.1
  25. Upgrade

    Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.

    Fixed in 5.15.0-1098.104
  26. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1095.100
  27. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 5.15.0-173.183
  28. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-106.106.1~22.04.1
  29. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 5.15.0-1098.99
  30. Upgrade

    Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1049.52~22.04.1
  31. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 5.15.0-1055.55
  32. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.

    Fixed in 5.15.0-1044.44
  33. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.15.0-1100.106
  34. Upgrade

    Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1047.48~22.04.1
  35. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.15.0-1097.100
  36. Upgrade

    Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-106.106~22.04.1
  37. Upgrade

    Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1067.71
  38. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.15.0-1086.88
  39. Upgrade

    Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1094.96
  40. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1102.111
  41. Upgrade

    Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.1-1045.46~22.04.1
  42. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1103.110+fips1
  43. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1109.118+fips1
  44. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-173.183+fips1
  45. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1103.112+fips1
  46. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.8.0-106.106
  47. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.8.0-1050.53
  48. Upgrade

    Upgrade ubuntu/linux-aws-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1009.9~24.04.2
  49. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.8.0-1051.57
  50. Upgrade

    Upgrade ubuntu/linux-azure-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1010.10~24.04.1
  51. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 6.8.0-1058.65
  52. Upgrade

    Upgrade ubuntu/linux-azure-nvidia to a version that resolves this vulnerability.

    Fixed in 6.8.0-1039.42
  53. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.8.0-1052.55
  54. Upgrade

    Upgrade ubuntu/linux-gcp-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1009.9~24.04.3
  55. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 6.8.0-1048.53
  56. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 6.8.0-1035.38
  57. Upgrade

    Upgrade ubuntu/linux-hwe-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-19.19~24.04.2
  58. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 6.8.0-1049.49
  59. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-106.106.1
  60. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 6.8.0-1049.52
  61. Upgrade

    Upgrade ubuntu/linux-nvidia-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1014.14
  62. Upgrade

    Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-1049.52.1
  63. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 6.8.0-1020.20
  64. Upgrade

    Upgrade ubuntu/linux-oem-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1017.17
  65. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.8.0-1047.48
  66. Upgrade

    Upgrade ubuntu/linux-oracle-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1009.9~24.04.1
  67. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.8.0-1050.54
  68. Upgrade

    Upgrade ubuntu/linux-riscv-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-19.19.1~24.04.1
  69. Upgrade

    Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.

    Fixed in 6.8.0-1028.29
  70. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 6.8.0-1017.21
  71. Upgrade

    Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.0-2040.41
  72. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.1-1045.46
  73. Upgrade

    Upgrade ubuntu/linux-realtime-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1008.9~24.04.1
  74. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1050.53+fips1
  75. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1052.58+fips1
  76. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-106.106+fips1
  77. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1052.55+fips1
  78. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.17.0-19.19
  79. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.17.0-1009.9
  80. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.17.0-1010.10
  81. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.17.0-1009.9
  82. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.17.0-1009.9
  83. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.17.0-1010.10
  84. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.17.0-1008.9
  85. Upgrade

    Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.

    Fixed in 6.17.0-19.19.1
  86. Compensating control

    Update the Linux net: atlantic RX-path handling to assume an extra fragment when buff->len > AQ_CFG_RX_HDR_SIZE, account for all fragments, and reuse the existing fragment-count check before calling skb_add_rx_frag() to prevent the overflow.

Event History

Dec 16, 2025
CVE Published
via MITRE·03:06 PM
Data Sourced
via MITRE·03:06 PM
DescriptionSeverity
Data Sourced
via Red Hat·04:05 PM
DescriptionSeverityAffected Software
Data Sourced
via OSV·04:16 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·04:16 PM
DescriptionSeverity
Dec 18, 2025
Data Sourced
via Microsoft·01:03 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·01:03 AM
Affected Software
Jul 8, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2025-68301?

CVE-2025-68301 has been classified as a potentially high-severity vulnerability due to its impact on memory management in the Linux kernel.

2

How do I fix CVE-2025-68301?

To fix CVE-2025-68301, update your Linux kernel to the latest version where the vulnerability has been patched.

3

What systems are affected by CVE-2025-68301?

CVE-2025-68301 affects systems using the Atlantic driver in the Linux kernel that handle large multi-descriptor packets.

4

What type of vulnerability is CVE-2025-68301?

CVE-2025-68301 is a memory management vulnerability that can result in out-of-bounds memory access.

5

Is CVE-2025-68301 actively being exploited?

As of the latest updates, there is no reported active exploitation of CVE-2025-68301, but it is crucial to apply patches to mitigate risks.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203