CVE-2025-21785

What it actually does

Out-of-bounds write in the arm64 cacheinfo population loop when separate instruction and data caches at the same level cause the index to be incremented only per level instead of per leaf, allowing writes past the allocated array bounds.

Why it matters to the business

Memory corruption on arm64 Linux systems can lead to kernel instability, crashes, or potential privilege escalation; high ecosystem prevalence in servers, cloud, and embedded devices increases exposure.

How an attack unfolds

An attacker with local access triggers cache topology detection (during boot or via sysfs queries) to cause the flawed loop to write attacker-controlled or adjacent data beyond the cacheinfo array, enabling memory corruption that can be chained to kernel code execution, similar to patterns seen in other Linux kernel privilege-escalation flaws.

How to fix it

Upgrade the Linux kernel to the fixed commit 4371ac7b494e933fffee2bd6265d18d73c4f05aa or later stable releases containing the patch; rebuild and reboot affected systems.

How to confirm the fix worked

Verify the running kernel contains commit 4371ac7b494e933fffee2bd6265d18d73c4f05aa via git log or kernel version string; inspect arch/arm64/kernel/cacheinfo.c for the corrected index-increment logic on leaves.

Typical attack path

1. Obtain local unprivileged access on arm64 Linux
2. Trigger cacheinfo population via boot, CPU hotplug, or /sys/devices/system/cpu queries
3. Exploit out-of-bounds write to corrupt kernel memory structures
4. Escalate to ring-0 code execution or cause denial of service

How to detect it

Review kernel logs for out-of-bounds write warnings or cacheinfo array panics around boot or CPU online events; correlate with process activity querying CPU cache topology.

What your security team should do

• Prioritize patching arm64 Linux kernels within 30 days given upstream resolution and related kernel exploitation activity
• Apply the specific commit 4371ac7b494e933fffee2bd6265d18d73c4f05aa across all distributions and rebuild initramfs
• Monitor for kernel oops or cacheinfo-related panics post-deployment
• Restrict unprivileged access to CPU topology interfaces until patched