Skip to main content

Linux Kernel CVE-2025-68195

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Amd Suse
7.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
6.1 MEDIUM

Local low-priv trigger on Zen5 (AV:L/PR:L); a small out-of-bounds table read yields limited disclosure (C:L) but can panic the kernel (A:H), with no integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:23 vuln.today
CVE Published
Dec 16, 2025 - 14:15 cve.org
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

x86/CPU/AMD: Add missing terminator for zen5_rdseed_microcode

Running x86_match_min_microcode_rev() on a Zen5 CPU trips up KASAN for an out of bounds access.

AnalysisAI

Out-of-bounds memory access in the Linux kernel's AMD CPU microcode-matching logic affects systems running on AMD Zen5 processors, where the zen5_rdseed_microcode revision table lacks a terminating sentinel entry. When x86_match_min_microcode_rev() iterates this array during CPU initialization on a Zen5 part, it reads past the array bounds, tripping KASAN and potentially disclosing adjacent kernel memory or causing instability. No public exploit identified at time of analysis, and EPSS risk is low (0.16%, 6th percentile).

Technical ContextAI

The flaw lives in arch/x86 AMD CPU support code that matches the running processor against a table of minimum microcode revisions (the zen5_rdseed_microcode array, related to the AMD RDSEED microcode erratum mitigation). Such tables in the kernel are conventionally NULL/zero-terminated so iteration helpers like x86_match_min_microcode_rev() know where to stop; the missing terminator means the loop walks one or more entries beyond the allocated array. Although the input lists CWE as N/A, the root cause is a classic out-of-bounds read (CWE-125) driven by a missing array terminator, surfaced here by the Kernel Address Sanitizer (KASAN) which explicitly flags the out-of-bounds access. The condition only manifests on AMD Zen5 microarchitecture CPUs, since that is the code path the missing terminator sits in.

Affected ProductsAI

The affected product is the mainline/stable Linux kernel on systems using AMD Zen5 (family 1Ah) processors, in versions that introduced the zen5_rdseed_microcode table without its terminator. Exact affected version ranges are not enumerated in the provided data (CWE is N/A and no CPE strings were supplied); the fix is tracked via the stable kernel git tree in commits 4c6b56a76478bd1ab609827c571905386c11d308 and f1fdffe0afea02ba783acfe815b6a60e7180df40 (https://git.kernel.org/stable/c/4c6b56a76478bd1ab609827c571905386c11d308 and https://git.kernel.org/stable/c/f1fdffe0afea02ba783acfe815b6a60e7180df40), which indicate backporting into stable branches.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update that adds the missing terminator to zen5_rdseed_microcode, corresponding to stable git commits 4c6b56a76478bd1ab609827c571905386c11d308 and f1fdffe0afea02ba783acfe815b6a60e7180df40 (see https://git.kernel.org/stable/c/4c6b56a76478bd1ab609827c571905386c11d308). In practice, install the latest stable/LTS kernel package from your distribution once these commits are backported, then reboot to load it. No exact tagged release version is provided in the input, so confirm the specific fixed version with your distribution's security tracker before deployment. There is no clean runtime workaround since the code path executes during CPU init on Zen5 hardware; the only true mitigation short of patching is limiting local untrusted access to affected Zen5 hosts, which does not remove the bug but reduces who can observe or trigger any resulting KASAN/instability behavior.

More in Amd

View all
CVE-2021-22986 CRITICAL POC
9.8 Mar 31

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
CVE-2020-6103 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6102 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6101 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6100 CRITICAL POC
9.9 Jul 20

An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. Rated criti
CVE-2018-6546 CRITICAL POC
9.8 Apr 13

plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming
CVE-2021-3653 HIGH POC
8.8 Sep 29

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. Rated high severity (CVSS 8.8), this vu
CVE-2020-12138 HIGH POC
8.8 Apr 27

AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of se
CVE-2019-5098 HIGH POC
8.6 Dec 05

An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. Rated high
CVE-2015-7724 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2015-7723 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2023-1048 HIGH POC
7.8 Feb 26

A vulnerability, which was classified as critical, has been found in TechPowerUp Ryzen DRAM Calculator 1.2.0.5.sys. Rate

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-68195 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy