CVE-2025-68751: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68751 is a false-positive Kernel Memory Sanitizer (KMSAN) report vulnerability in the Linux kernel's s390/fpu module, specifically in the fpu_vstl() function. The issue arises from a mismatch between compile-time inline assembly constraints and the runtime behavior of the s390 vstl instruction, which writes a variable number of bytes depending on an index argument. It affects the Linux kernel on s390/s390x architectures compiled with clang and KMSAN enabled. The vulnerability was published on January 5, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) with availability impact only (Red Hat CVE, Red Hat Bugzilla).

The root cause is an instrumentation mismatch in the fpu_vstl() function on s390 architecture. The vstl inline assembly instruction writes a variable number of bytes at runtime depending on the index argument (at least 2 bytes when index > 0), but clang evaluates inline assembly constraints at compile time and generates a call to __msan_instrument_asm_store with a hardcoded size of 1 byte. This causes KMSAN to incorrectly flag memory written by vstl as uninitialized, producing false-positive uninit-value reports in the kernel's network stack (e.g., virtqueue_add, start_xmit, arp_process). The fix involves manually invoking the KMSAN function with the correct byte count rather than relying on the compiler-generated constraint-based instrumentation (Red Hat Bugzilla, Red Hat CVE).

The primary impact is availability: the false-positive KMSAN reports generate misleading kernel bug messages (BUG: KMSAN: uninit-value) during routine network operations such as running ping, potentially causing system noise and masking real memory safety issues on affected s390/s390x systems. There is no confidentiality or integrity impact, as no actual memory corruption or data exposure occurs. Systems using KMSAN for security monitoring may experience degraded reliability of their sanitizer tooling, reducing the effectiveness of runtime memory safety checks (Red Hat CVE, Red Hat Bugzilla).

Apply the upstream kernel patches available via the stable kernel tree, referenced in three commits: 13dcd6308cb8, 14e4e4175b64, and 946357a538bb. Red Hat has tracked this issue under Bug ID 2427120 and recommends updating to a patched kernel version once available from your distribution. The fix is specifically relevant to s390/s390x systems running a clang-compiled kernel with KMSAN enabled; systems not using KMSAN or not on s390 architecture are not affected (Red Hat Bugzilla, Red Hat CVE).