CVE-2025-21785arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level).
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5d425c18653731af62831d30a4fa023d532657a9 before 4371ac7b494e933fffee2bd6265d18d73c4f05aa; from 5d425c18653731af62831d30a4fa023d532657a9 before e4fde33107351ec33f1a64188612fbc6ca659284; from 5d425c18653731af62831d30a4fa023d532657a9 before 88a3e6afaf002250220793df99404977d343db14; 5d425c18653731af62831d30a4fa023d532657a9 builds before 4ff25f0b18d1d0174c105e4620428bcdc1213860; from 5d425c18653731af62831d30a4fa023d532657a9 before ab90894f33c15b14c1cee6959ab6c8dcb09127f8; from 5d425c18653731af62831d30a4fa023d532657a9 before 715eb1af64779e1b1aa0a7b2ffb81414d9f708e5; from 5d425c18653731af62831d30a4fa023d532657a9 before 67b99a2b5811df4294c2ad50f9bff3b6a08bd618; from 5d425c18653731af62831d30a4fa023d532657a9 before 875d742cf5327c93cba1f11e12b08d3cce7a88d2 | CNA record |
linux linux_kernel linux:linux_kernel | from 4.0 before 6.1.129; from 6.2 before 6.6.79; from 6.7 before 6.12.16; from 6.13 before 6.13.4; 6.14; 6.14 | NVD |
References
- https://git.kernel.org/stable/c/4371ac7b494e933fffee2bd6265d18d73c4f05aa
- https://git.kernel.org/stable/c/e4fde33107351ec33f1a64188612fbc6ca659284
- https://git.kernel.org/stable/c/88a3e6afaf002250220793df99404977d343db14
- https://git.kernel.org/stable/c/4ff25f0b18d1d0174c105e4620428bcdc1213860mailing-list, patch
- https://git.kernel.org/stable/c/ab90894f33c15b14c1cee6959ab6c8dcb09127f8mailing-list, patch
- https://git.kernel.org/stable/c/715eb1af64779e1b1aa0a7b2ffb81414d9f708e5mailing-list, patch
- https://git.kernel.org/stable/c/67b99a2b5811df4294c2ad50f9bff3b6a08bd618mailing-list, patch
- https://git.kernel.org/stable/c/875d742cf5327c93cba1f11e12b08d3cce7a88d2mailing-list, patch
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.