External risk intelligence

Linux Kernel Network Driver Fragment Overflow Leads to Kernel Panic

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-68301

This vulnerability exists within a Linux kernel network driver (atlantic). It requires specific hardware (Aquantia AQC113 NIC) and occurs during low-level packet fragment processing. It is not an internet-facing service or application, but rather an internal kernel-level component handling hardware interrupts, making direct public network exploitation extremely unlikely.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's network driver could lead to system instability or crashes, specifically affecting a particular type of network hardware. While not directly exploitable over the internet, this issue could be triggered by crafted network traffic, potentially impacting server reliability. The main concern is confirming relevance and exposure within your environment.

Kernel issue impacts network packet handling.
System crashes could affect service availability.
Confirm if specific hardware is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network packets to a system with a vulnerable Linux kernel driver. The driver mishandles an excessive number of packet fragments, causing an out-of-bounds write within the kernel's memory. This can lead to a kernel panic, effectively crashing the entire system.

Requires network access.
Triggered by malformed network packets.
Results in a system crash.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect systems running the Linux kernel with a specific network interface card when processing large network packets. An issue in fragment handling could lead to a system crash.

Kernel and system stability.
Malformed network packets could trigger the issue.
Denial of service due to system crash.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's network driver for Aquantia NICs could lead to a kernel panic if exploited by specially crafted packets. The direct impact is a system crash, not data compromise, but it necessitates immediate attention from teams responsible for the Linux operating system and its hardware, particularly those managing servers with this specific network interface. The first step is to identify all systems with Aquantia AQC113 NICs, assess their business criticality, and then plan remediation, potentially involving coordinated vendor engagement and maintenance window scheduling.

Infrastructure and platform teams own the issue.
Verify affected Aquantia NICs and system criticality.
Plan and schedule kernel updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the atlantic driver in the Linux kernel?

The atlantic driver is a software component within the Linux kernel designed to manage network communication for specific hardware, such as the Aquantia AQC113 10G network interface card. Its primary role is to handle the transmission and reception of data packets between the hardware and the operating system.

What is the vulnerability class for CVE-2025-68301?

CVE-2025-68301 is categorized as an out-of-bounds write vulnerability. This occurs when software attempts to write data beyond the designated boundaries of a memory buffer. In this instance, the driver improperly manages packet fragments, leading to memory corruption that triggers a kernel panic and crashes the system.

How is this CVE-2025-68301 vulnerability triggered?

The issue is triggered when the system receives a network packet containing more fragments than the driver is designed to handle. Normal, correctly formed packets do not trigger this defect. The crash specifically occurs when the driver fails to validate the fragment count before processing, causing it to exceed defined array limits.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that exploitation is very unlikely. Because this flaw resides in an internal, low-level kernel driver handling hardware interrupts rather than an internet-facing application, it is not directly reachable by public network traffic, which significantly limits the potential for remote exploitation.

What should I do if I run this technology?

First, identify if any of your systems are equipped with Aquantia AQC113 network hardware. If you confirm the presence of this hardware, prioritize evaluating the business criticality of those specific machines. Coordinate with your infrastructure teams to schedule maintenance windows for applying the necessary kernel updates provided by your distribution vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.