CVE-2025-68301

An out-of-bounds write vulnerability was found in the Aquantia Atlantic network driver in the Linux kernel. When receiving packets that span more than MAX_SKB_FRAGS (17) fragments, the driver writes beyond the skb fragment array bounds in skb_add_rx_frag(), causing kernel memory corruption and panic.

This affects systems with Aquantia AQC network adapters processing large fragmented packets. Network-adjacent attackers could potentially craft packets to trigger this condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the atlantic module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.