{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-21785", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.765Z", "datePublished": "2025-02-27T02:18:25.938Z", "dateUpdated": "2026-08-05T11:54:23.832Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:23.832Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array\n\nThe loop that detects/populates cache information already has a bounds\ncheck on the array size but does not account for cache levels with\nseparate data/instructions cache. Fix this by incrementing the index\nfor any populated leaf (instead of any populated level)." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The defect lives in arm64 CPU cacheinfo initialization, reached only through local CPU bring-up (`update_siblings_masks()`) and the CPUHP_AP_BASE_CACHEINFO_ONLINE hotplug callback on the machine itself; there is no network, adjacent-network, or remote-peer data path into `populate_cache_leaves()`.\nAC:L - On an affected platform the overflow is fully deterministic — whenever firmware (DT `cache-unified`/single `cache-size`, or ACPI PPTT `split_levels`) under-counts leaves relative to a `CLIDR_EL1` level reporting `CACHE_TYPE_SEPARATE`, the level-vs-leaf counter mismatch fires on every execution of the loop. There is no race, no timing window, and no memory-layout condition to win.\nPR:L - The vulnerable loop executes with no `capable()` check, no LSM gate, and no authentication anywhere on the path — it runs as part of normal CPU bring-up on behalf of the system, so no elevated credentials are required for the out-of-bounds write to occur; scoring at low local privilege rather than high since nothing on the path demands real root.\nUI:N - No victim action of any kind is needed — the out-of-bounds write happens autonomously during secondary-CPU initialization as part of ordinary system startup.\nS:U - The corruption is confined to the kernel's own slab allocations on the same host; no VM/hypervisor, IOMMU/DMA, or sandbox authority boundary is crossed.\nC:H - The heap out-of-bounds write clobbers `type` and `level` fields at fixed strides across up to several hundred bytes of adjacent slab objects allocated during early boot; corrupting neighbouring structures' length, index, or pointer fields is a classic route to kernel memory disclosure, so per memory-corruption guidance this is High.\nI:H - This is a direct out-of-bounds write past a `kcalloc()`'d `struct cacheinfo` array, silently modifying kernel heap memory belonging to unrelated objects — out-of-bounds writes are scored High for integrity because slab corruption is the standard primitive for control-flow hijack.\nA:H - Overwriting adjacent early-boot slab objects can corrupt pointers or allocator metadata, producing an oops, panic, or unbootable system; because it occurs during CPU bring-up on affected platforms, the result is complete loss of availability of the machine." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/arm64/kernel/cacheinfo.c" ], "versions": [ { "version": "5d425c18653731af62831d30a4fa023d532657a9", "lessThan": "4371ac7b494e933fffee2bd6265d18d73c4f05aa", "status": "affected", "versionType": "git" }, { "version": "5d425c18653731af62831d30a4fa023d532657a9", "lessThan": "e4fde33107351ec33f1a64188612fbc6ca659284", "status": "affected", "versionType": "git" }, { "version": "5d425c18653731af62831d30a4fa023d532657a9", "lessThan": "88a3e6afaf002250220793df99404977d343db14", "status": "affected", "versionType": "git" }, { "version": "5d425c18653731af62831d30a4fa023d532657a9", "lessThan": "4ff25f0b18d1d0174c105e4620428bcdc1213860", "status": "affected", "versionType": "git" }, { "version": "5d425c18653731af62831d30a4fa023d532657a9", "lessThan": "ab90894f33c15b14c1cee6959ab6c8dcb09127f8", "status": "affected", "versionType": "git" }, { "version": "5d425c18653731af62831d30a4fa023d532657a9", "lessThan": "715eb1af64779e1b1aa0a7b2ffb81414d9f708e5", "status": "affected", "versionType": "git" }, { "version": "5d425c18653731af62831d30a4fa023d532657a9", "lessThan": "67b99a2b5811df4294c2ad50f9bff3b6a08bd618", "status": "affected", "versionType": "git" }, { "version": "5d425c18653731af62831d30a4fa023d532657a9", "lessThan": "875d742cf5327c93cba1f11e12b08d3cce7a88d2", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/arm64/kernel/cacheinfo.c" ], "versions": [ { "version": "4.0", "status": "affected" }, { "version": "0", "lessThan": "4.0", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.291", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.235", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.179", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.129", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.79", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.16", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.4", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "5.4.291" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "5.10.235" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "5.15.179" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.1.129" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.6.79" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.12.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.13.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/4371ac7b494e933fffee2bd6265d18d73c4f05aa" }, { "url": "https://git.kernel.org/stable/c/e4fde33107351ec33f1a64188612fbc6ca659284" }, { "url": "https://git.kernel.org/stable/c/88a3e6afaf002250220793df99404977d343db14" }, { "url": "https://git.kernel.org/stable/c/4ff25f0b18d1d0174c105e4620428bcdc1213860" }, { "url": "https://git.kernel.org/stable/c/ab90894f33c15b14c1cee6959ab6c8dcb09127f8" }, { "url": "https://git.kernel.org/stable/c/715eb1af64779e1b1aa0a7b2ffb81414d9f708e5" }, { "url": "https://git.kernel.org/stable/c/67b99a2b5811df4294c2ad50f9bff3b6a08bd618" }, { "url": "https://git.kernel.org/stable/c/875d742cf5327c93cba1f11e12b08d3cce7a88d2" } ], "title": "arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:59:30.431Z" } } ] } }