Old Attack, New Speed: Researchers Optimize Page Cache Exploits

A team of researchers from the Graz University of Technology in Austria has revived Linux page cache attacks, showing they are faster and more practical than previously thought. The paper details attack techniques that target Linux kernels from 2003 to present day, with an operation called flushing taking 0.8 microseconds compared with 149 milliseconds in prior work, according to Sudheendra Raghav Neela.

They claim a full attack loop can be executed in just 0.6–2.3 microseconds, over five to six orders of magnitude faster than earlier page-cache attacks. The researchers outline several theoretical scenarios, including a Docker container scenario where an attacker can see which files another container accesses, and an attack involving the Discord application to infer user actions.

They note that the only mitigated issue so far is CVE-2025-21691, reported to the Linux kernel security team in January 2025, and that the attack surface remains for current kernel versions.