CVE-2025-68301: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68301 is an out-of-bounds write vulnerability in the Linux kernel's Atlantic (Aquantia) network driver affecting the RX (receive) path. The flaw allows the driver to process packets with more than MAX_SKB_FRAGS (17) fragments without proper bounds checking, leading to a kernel panic via an out-of-bounds write in skb_add_rx_frag_netmem(). It affects Linux kernel versions used in systems with Aquantia AQC113 10G NICs, and was disclosed on December 16, 2025. Affected downstream products include Microsoft Azure Linux 3 (kernel 6.6.117.1-1) and IBM Netezza Appliance. It carries a CVSS v3.1 base score of 7.0 (High) (Red Hat CVE, Microsoft MSRC).

The root cause is a missing bounds check in the Atlantic driver's RX path (CWE-787: Out-of-bounds Write). When the driver receives large multi-descriptor network packets that require more than MAX_SKB_FRAGS (17) fragments, it calls skb_add_rx_frag() without first verifying the total fragment count, causing the fragment index to exceed the skb_shared_info.frags[] array bounds. The fix adds a preemptive check by accounting for an extra fragment when buff->len > AQ_CFG_RX_HDR_SIZE, and reuses an existing overflow guard earlier in the code path to prevent the write. The vulnerability was confirmed in production with an Aquantia AQC113 10G NIC, with the crash occurring at RIP: 0010:skb_add_rx_frag_netmem+0x29/0xd0 (Red Hat CVE).

Successful exploitation causes a kernel panic, resulting in a complete system crash and denial of service. Because the out-of-bounds write corrupts kernel memory, there is also a theoretical risk of high-impact confidentiality and integrity compromise, as reflected in the CVSS scoring (C:H/I:H/A:H). The vulnerability is limited to systems equipped with Aquantia AQC113 (or compatible) 10G NICs running affected Linux kernel versions, and lateral movement potential is constrained by the local attack vector (Red Hat CVE, IBM Advisory).

• Logs: Kernel panic messages referencing skb_add_rx_frag_netmem or aq_ring_rx_fill in /var/log/kern.log or system journal; stack traces showing RIP: 0010:skb_add_rx_frag_netmem+0x29/0xd0 in crash dumps or dmesg output.
• System Behavior: Unexpected system reboots or kernel oops events on hosts equipped with Aquantia AQC113 10G NICs; repeated kernel panics correlated with high-throughput or large multi-descriptor network packet reception.
• Network: Anomalous large fragmented packet flows directed at the affected NIC that could trigger the fragment overflow condition.

The primary remediation is to update to a patched Linux kernel version. Patches have been backported and are available via multiple vendor channels: Red Hat (RHSA-2026:0759, RHSA-2026:0760, RHSA-2026:1143, and subsequent advisories), Debian LTS (DLA-4436-1), Ubuntu (USN-8094-x, USN-8096-x, USN-8152-1), AlmaLinux (ALSA-2026-0759), Rocky Linux (RLSA-2026:0760, RLSA-2026:1143), SUSE, and Microsoft Azure Linux 3 (kernel 6.6.117.1-1). As a temporary workaround, administrators can disable or restrict use of the Atlantic network driver (aq_nic module) on affected systems if the NIC is not required, and implement network access controls to reduce exposure to crafted large packet flows (Red Hat Errata, Debian LTS, Ubuntu USN-8096-1, IBM Advisory).