CVE-2025-68195: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68195 is a Linux kernel vulnerability affecting x86 AMD CPU handling, specifically a missing array terminator in the zen5_rdseed_microcode table. When x86_match_min_microcode_rev() is called on a Zen5 CPU, the absence of a sentinel/terminator entry causes KASAN (Kernel Address Sanitizer) to detect an out-of-bounds memory access. The vulnerability was published on December 16, 2025, and affects specific Linux kernel versions in the stable tree. No CVSS score has been assigned at this time, and the EPSS score is approximately 0.018% (Feedly, EUVD).

The root cause is a missing terminator entry (sentinel) in the zen5_rdseed_microcode array used by the AMD CPU microcode matching logic in the Linux kernel's x86 architecture code (CWE-125: Out-of-bounds Read). When x86_match_min_microcode_rev() iterates over this array on a Zen5 CPU, it reads past the end of the array because no null/zero terminator is present to signal the end of the list, triggering a KASAN out-of-bounds access report. The fix involves adding the missing terminator to the array, as committed in the stable kernel tree (kernel.org patch 1, kernel.org patch 2).

Exploitation of this vulnerability could result in kernel memory disclosure or system instability on x86 systems running AMD Zen5 CPUs, as the out-of-bounds read may expose kernel memory contents or cause unpredictable behavior. In practice, the primary observed impact is a KASAN warning/crash during kernel initialization or CPU feature detection, which could affect system availability. The confidentiality impact is limited but non-zero, as out-of-bounds reads can potentially leak adjacent kernel memory (Feedly).

The fix has been committed to the Linux stable kernel tree in two patches: commit 4c6b56a76478bd1ab609827c571905386c11d308 and commit f1fdffe0afea02ba783acfe815b6a60e7180df40. Administrators running AMD Zen5 CPUs on affected Linux kernel versions should update to a patched kernel version that includes these commits. No configuration-based workaround is known; upgrading the kernel is the recommended remediation (kernel.org patch 1, kernel.org patch 2).

The vulnerability has been noted in Yocto Project security mailing lists, indicating awareness in the embedded Linux community. No significant vendor statements, researcher commentary, or media coverage beyond standard vulnerability tracking has been observed for this issue (Yocto Security List).