The Linux kernel atlantic driver mishandles packets with more than MAX_SKB_FRAGS (17) fragments, causing an out-of-bounds write in skb_add_rx_frag_netmem(). This occurs because the driver fails to verify the total fragment count before calling skb_add_rx_frag(), allowing the fragment index to exceed array bounds. The flaw leads to kernel panic and was observed in production with an Aquantia AQC113 10G NIC. The fix involves assuming an extra fragment if the buffer length exceeds AQ_CFG_RX_HDR_SIZE and reusing existing checks to prevent overflow earlier in the RX path.

Successful exploitation results in an out-of-bounds write in kernel memory, causing a kernel panic and denial of service. The vulnerability affects system stability and could potentially be leveraged for further kernel-level compromise, given the high severity of the memory corruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates a fix has been developed and merged into the Linux kernel source, but no explicit patch link or version is provided. Users should monitor official Linux kernel releases and update to a version that includes the fix for CVE-2025-68301 once available.