CVE-2025-21785
Published: 27 February 2025
Summary
CVE-2025-21785 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-21785 is a vulnerability in the Linux kernel's arm64 cacheinfo subsystem that leads to an out-of-bounds write in the cacheinfo array. The issue arises during the loop that detects and populates cache information, which includes a bounds check on the array size but fails to account for cache levels with separate data and instruction caches. As a result, the index is not properly incremented for populated leaves, potentially allowing writes beyond the array bounds. The vulnerability is classified under CWE-787 (Out-of-bounds Write) with a CVSS v3.1 base score of 7.8.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low complexity (AC:L) and no user interaction required (UI:N), requiring only local access (AV:L) to the system. Successful exploitation could result in high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), potentially enabling arbitrary code execution, data corruption, or system crashes due to the out-of-bounds write.
Mitigation involves applying the upstream patches referenced in the stable kernel repositories, such as commits 4371ac7b494e, 4ff25f0b18d1, 67b99a2b5811, 715eb1af64779, and 875d742cf532. These fixes resolve the issue by modifying the loop to increment the index for any populated leaf rather than any populated level, ensuring proper bounds handling for separate data and instruction caches. Security practitioners should update affected Linux kernels, particularly those using arm64 architectures, to the patched versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5132
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels…
more
with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel out-of-bounds write vulnerability enabling arbitrary code execution and privilege escalation from low-privileged local access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely flaw remediation directly prevents exploitation by requiring patching of the out-of-bounds write vulnerability in the Linux kernel's arm64 cacheinfo subsystem.
Vulnerability monitoring and scanning identifies the presence of CVE-2025-21785 in deployed arm64 Linux kernels to enable remediation.
Memory protection safeguards like address space randomization and non-executable memory mitigate successful exploitation of the out-of-bounds write for code execution or corruption.