Cachestat Permission Check Vulnerability in Linux Kernel
Summary
DEBIAN-CVE-2025-21691: In the Linux kernel, the following vulnerability has been resolved: cachestat: fix page cache statistics permission checking When the 'cachestat()' system call was added in commit cf264e1329fb ("cachestat: implement cach... Affects linux versions < 6.12.12-1. Fixed in 6.12.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages system resources and provides essential services for software applications. The kernel's functionality includes process management, memory management, device management, and system calls. This vulnerability specifically affects the 'cachestat()' system call, which was designed to provide efficient access to page cache statistics without requiring memory mapping. However, it lacked proper permission checks, making it susceptible to unauthorized access.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the 'cachestat()' system call, which was introduced to enhance performance by avoiding the need for mapping into user virtual address space. The vulnerability arose from the omission of necessary permission checks that were implemented in a previous system call, 'mincore()'. This oversight allows unauthorized users to access page cache statistics, potentially leading to information disclosure and exploitation of system resources.
How To Fix
Minimum fixed version
6.12.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux kernel.
Conclusion
The vulnerability in the Linux kernel's 'cachestat()' system call poses a significant risk due to the lack of proper permission checks. It is crucial to update to the patched version (6.12.12-1) to mitigate this risk. Users should remain vigilant and utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for linux →
FAQ
The 'cachestat()' system call is designed to provide efficient access to page cache statistics without the need for mapping memory into the user virtual address space.
The primary risk is unauthorized access to page cache statistics, which could lead to information disclosure and exploitation of system resources.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected without requiring access to the code or installation.
While there are no specific workarounds, it is advisable to monitor your system closely and limit access to sensitive resources until the update can be applied.
Detailed information about this vulnerability can be found in the Debian CVE database and other security advisories related to the Linux kernel.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
