Security readout for executives and security teams
Plain-English summary
Affected 64-bit Arm Linux systems can write beyond an internal kernel array while discovering CPU cache information. The CVSS assessment indicates that a local, low-privileged user could potentially cause serious confidentiality, integrity, or availability impact. The supplied sources do not establish practical exploitability or active attacks.
Executive priority
Treat this as a high-priority arm64 kernel patching issue, especially on shared systems. It is not supported as an emergency internet-wide exploitation event. Expedite normal kernel maintenance, confirm reboot completion, and escalate systems allowing untrusted local workloads.
Technical view
The arm64 cacheinfo population loop checked array bounds but advanced its index per cache level rather than per populated cache leaf. Hardware exposing separate instruction and data caches could therefore produce more entries than accounted for, causing an out-of-bounds kernel write. Stable fixes increment the index for every populated leaf.
Likely exposure
Exposure is limited to affected Linux kernels on arm64 systems, particularly hardware with separate instruction and data caches. The supplied affected-version data is not sufficiently clear for reliable package-level conclusions. Internet reachability alone is not the primary factor because the CVSS vector requires local, low-privileged access.
Exploitation context
The CVSS 3.1 vector is local, low complexity, low privilege, and requires no user interaction, with potentially high impact across confidentiality, integrity, and availability. CISA KEV status is false in the supplied bundle, and no cited source establishes active exploitation, a public exploit, or demonstrated attack reliability.
Researcher notes
The defect is an array-accounting mismatch involving cache leaves versus cache levels. Separate instruction and data caches can consume multiple leaves at one level. The supplied commits show stable-branch remediation, but the bundle does not prove exploit primitives, trigger reliability, affected hardware breadth, or observed exploitation.
Mitigation direction
- Apply the distribution-supported kernel update containing the relevant stable fix.
- Reboot affected systems so the corrected kernel is actually running.
- Prioritize shared arm64 hosts where untrusted or low-privileged users can execute code.
- Check Linux distribution security guidance when package-level fixed versions are unclear.
Validation and detection
- Inventory arm64 systems and record installed and currently running kernel versions.
- Compare each kernel package against its distribution advisory and stable fix lineage.
- Confirm systems were rebooted into the updated kernel after patching.
- Review affected hosts for unexplained kernel crashes or memory-corruption reports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21785 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4371ac7b494e933fffee2bd6265d18d73c4f05aaCVE reference, Linux
- https://git.kernel.org/stable/c/e4fde33107351ec33f1a64188612fbc6ca659284CVE reference, Linux
- https://git.kernel.org/stable/c/88a3e6afaf002250220793df99404977d343db14CVE reference, Linux
- https://git.kernel.org/stable/c/4ff25f0b18d1d0174c105e4620428bcdc1213860CVE reference, Linux
- https://git.kernel.org/stable/c/ab90894f33c15b14c1cee6959ab6c8dcb09127f8CVE reference, Linux
- https://git.kernel.org/stable/c/715eb1af64779e1b1aa0a7b2ffb81414d9f708e5CVE reference, Linux
- https://git.kernel.org/stable/c/67b99a2b5811df4294c2ad50f9bff3b6a08bd618CVE reference, Linux
- https://git.kernel.org/stable/c/875d742cf5327c93cba1f11e12b08d3cce7a88d2CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.