CVE-2025-68301

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: atlantic: fix fragment overflow handling in RX path

The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17)

fragments when handling large multi-descriptor packets. This causes an

out-of-bounds write in skb_add_rx_frag_netmem() leading to kernel panic.

The issue occurs because the driver doesn't check the total number of

fragments before calling skb_add_rx_frag(). When a packet requires more

than MAX_SKB_FRAGS fragments, the fragment index exceeds the array bounds.

Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE,

then all fragments are accounted for. And reusing the existing check to

prevent the overflow earlier in the code path.

This crash occurred in production with an Aquantia AQC113 10G NIC.

Stack trace from production environment:

```

RIP: 0010:skb_add_rx_frag_netmem+0x29/0xd0

Code: 90 f3 0f 1e fa 0f 1f 44 00 00 48 89 f8 41 89

ca 48 89 d7 48 63 ce 8b 90 c0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References