CVE-2025-21785 – This CVE describes an out-of-bounds write vulne... (How to Fix)

Q: What is the severity of CVE-2025-21785?

CVE-2025-21785 has a CVSS score of 7.8 (HIGH). This CVE describes an out-of-bounds write vulnerability in the Linux kernel's ARM64 cacheinfo subsystem. The flaw could allow local attackers to corrupt kernel memory, potentially leading to privilege escalation or system crashes. It affects Linux systems running on ARM64 architecture with vulnerable kernel versions.

📋 TL;DR

This CVE describes an out-of-bounds write vulnerability in the Linux kernel's ARM64 cacheinfo subsystem. The flaw could allow local attackers to corrupt kernel memory, potentially leading to privilege escalation or system crashes. It affects Linux systems running on ARM64 architecture with vulnerable kernel versions.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific vulnerable versions not specified in CVE; check kernel commits for affected versions

Operating Systems: Linux distributions running on ARM64 architecture

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects ARM64 (AArch64) systems. Requires specific cache configurations with separate data/instruction caches.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to root, kernel panic leading to denial of service, or arbitrary code execution in kernel context.

🟠

Likely Case

Kernel panic causing system crash/reboot, or local privilege escalation if combined with other vulnerabilities.

🟢

If Mitigated

Limited impact due to requiring local access; proper access controls and kernel hardening reduce exploit success.

🌐 Internet-Facing: LOW - Requires local access to exploit, not directly reachable from network.

🏢 Internal Only: MEDIUM - Local users or compromised accounts could exploit this for privilege escalation within the system.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and knowledge of kernel memory layout. Exploitation depends on specific cache configuration.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check kernel commits: 4371ac7b494e933fffee2bd6265d18d73c4f05aa and related

Vendor Advisory: https://git.kernel.org/stable/c/4371ac7b494e933fffee2bd6265d18d73c4f05aa

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from distribution vendor. 2. Rebuild kernel if using custom build. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Restrict local user access

all

Limit local shell access to trusted users only

# Review /etc/passwd and /etc/shadow for unnecessary accounts
# Use sudo policies to restrict privileged operations

🧯 If You Can't Patch

Implement strict access controls to prevent untrusted local users
Enable kernel hardening features like KASLR, stack protection

🔍 How to Verify

Check if Vulnerable:

Check kernel version and architecture: uname -a should show ARM64/aarch64. Review kernel source for vulnerable cacheinfo.c code.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated beyond fix commits. Check /proc/cpuinfo for cache information without system crashes.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/kern.log or dmesg
Segmentation faults in kernel context
System crash/reboot events

Network Indicators:

None - local exploit only

SIEM Query:

source="kernel" AND ("panic" OR "Oops" OR "segfault") AND process="kernel"

📊 Metadata

CVE ID: CVE-2025-21785

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

EPSS Score: 0.04% exploit probability (13.4th percentile)

Published: February 27, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-21785, you might also want to check these: