CVE-2025-21785: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-21785 Overview

CVE-2025-21785 is an out-of-bounds write vulnerability in the Linux kernel's arm64cacheinfo subsystem. The flaw exists in the loop that detects and populates cache information for ARM64 processors. While the loop performs a bounds check on the array size, it fails to account for cache levels that have separate data and instruction caches. The result is a write past the end of the cacheinfo array on affected systems.

The issue is classified under [CWE-787] (Out-of-bounds Write) and affects local users on ARM64 Linux systems. The Linux kernel maintainers resolved the issue by incrementing the index for any populated leaf rather than any populated level.

Critical Impact
A local low-privileged user on an ARM64 Linux system can trigger an out-of-bounds write that corrupts adjacent kernel memory, potentially leading to privilege escalation, kernel memory corruption, or system instability.

Affected Products

Linux Kernel (multiple stable branches prior to the fix)
Linux Kernel 6.14-rc1
Linux Kernel 6.14-rc2

Discovery Timeline

2025-02-27 - CVE-2025-21785 published to the National Vulnerability Database (NVD)
2025-03 - Debian LTS Announcement March 2025 issued
2025-05 - Debian LTS Announcement May 2025 issued
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-21785

Vulnerability Analysis

The vulnerability resides in the ARM64 cacheinfo initialization code, which enumerates each cache level on a CPU and records metadata in a fixed-size array. On ARM64, a single cache level can expose two cache leaves when instruction and data caches are split. The original loop advanced its array index based on the cache level being populated rather than the number of leaves actually written. Systems with split instruction and data caches therefore wrote more entries than the bounds check anticipated.

Because the bounds check tracked levels and not leaves, a CPU topology that exposed both instruction and data caches at a given level caused the index to outrun the allocated array. The kernel then wrote cacheinfo structures into memory adjacent to the buffer, corrupting unrelated kernel data.

Root Cause

The root cause is an incorrect loop invariant in the ARM64 cacheinfo population routine. The index controlling array writes was incremented per cache level, not per populated leaf. Cache hierarchies with separate L1 instruction and data caches produce two leaves per level, so the index advanced too slowly relative to the actual number of writes, defeating the array bounds check.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker on an ARM64 system with a vulnerable cache topology can trigger initialization of cache metadata to corrupt kernel memory beyond the cacheinfo array. Successful corruption of adjacent kernel structures may enable privilege escalation or denial of service. The vulnerability is not network-reachable, and there is no public exploit or CISA KEV listing at this time.

The upstream patch corrects the loop to increment the index for every populated leaf rather than every populated level, restoring the integrity of the bounds check. Patch commits are available in the Linux stable tree, including 4ff25f0b18d1, 67b99a2b5811, 715eb1af6477, 875d742cf532, and ab90894f33c1.

Detection Methods for CVE-2025-21785

Indicators of Compromise

Unexplained kernel oops, panic, or BUG: messages referencing cacheinfo, cache_setup_of_node, or init_cache_level on ARM64 hosts during early boot or CPU hotplug events.
Memory corruption symptoms such as KASAN out-of-bounds write reports in the kernel log on ARM64 builds with KASAN enabled.
Unexpected privilege escalation or anomalous process behavior on multi-tenant ARM64 hosts running unpatched kernels.

Detection Strategies

Inventory all ARM64 Linux hosts and compare running kernel versions against the patched commits listed in the Linux kernel stable tree.
Enable kernel runtime hardening features such as KASAN in test environments to surface out-of-bounds writes during cache enumeration.
Monitor dmesg and journalctl -k for kernel warnings produced during CPU initialization on ARM64 servers and edge devices.

Monitoring Recommendations

Forward kernel logs from ARM64 fleets to a centralized logging or SIEM platform and alert on cacheinfo related stack traces.
Track package and kernel update status across ARM64 endpoints, cloud instances, and Kubernetes nodes to confirm patch deployment.
Audit local account usage on ARM64 systems to identify unexpected interactive sessions that could leverage local kernel flaws.

How to Mitigate CVE-2025-21785

Immediate Actions Required

Identify all ARM64 Linux systems running kernels prior to the fixed commits, including servers, cloud instances, and embedded or edge devices.
Apply the vendor-supplied kernel update from your distribution. Debian users should follow the Debian LTS March 2025 advisory and the Debian LTS May 2025 advisory.
Reboot updated systems so the patched kernel is loaded and cache enumeration runs against the corrected logic.
Restrict local access on multi-tenant ARM64 hosts until patches are deployed.

Patch Information

The upstream fix is available in the Linux kernel stable tree across multiple maintained branches. Reference commits include 4ff25f0b18d1, 67b99a2b5811, 715eb1af6477, 875d742cf532, and ab90894f33c1. Distribution vendors have backported the fix; apply updates through your standard package manager.

Workarounds

No supported workaround replaces the kernel patch. Limit local logins and untrusted code execution on ARM64 hosts until updates are applied.
Where rapid patching is not possible, isolate vulnerable ARM64 systems from untrusted users and workloads, and disable optional CPU hotplug operations that re-run cache enumeration.
Validate that container and virtualization hosts on ARM64 run patched kernels before exposing them to untrusted tenants.

bash

# Verify the running kernel version on ARM64 hosts
uname -rm

# Debian/Ubuntu: update and apply the patched kernel package
sudo apt update && sudo apt upgrade linux-image-arm64
sudo reboot

# RHEL/Fedora-based ARM64 systems
sudo dnf update kernel
sudo reboot