Eviction Notice: New Cache Attacks Break Linux and Docker Isolation

Researchers from the Austrian Institute of Technology presented a rigorous analysis and refinement of operating system page cache attacks at the NDSS 2026 conference. Their treatise, entitled “Eviction Notice,” elucidates how vulnerabilities within cache management mechanisms facilitate side-channel attacks executed with minimal system privileges and no administrative oversight.

The page cache is a segment of volatile memory where the operating system stores recently accessed disk data to accelerate subsequent retrieval. While this architecture significantly bolsters performance, it engenders substantial security risks. Should an adversary discern which file pages reside within the cache, they can extrapolate the actions of other users—such as determining if a password entry form was accessed or identifying visits to specific web domains.

Although initial page cache incursions were documented in 2019, this nascent research transcends previous boundaries. The team delineated four pivotal primitives—mechanisms for cache interaction: reload, flush, evict, and monitor. By orchestrating these primitives, one can construct five distinct attack methodologies, including Flush+Monitor and Evict+Reload. These techniques enable the surreptitious logging of keystrokes, the detection of active authentication interfaces, and the monitoring of internal application behaviors.

A paramount discovery involved the exploitation of the posix_fadvise system call with the POSIX_FADV_DONTNEED flag. This facilitates not only the purging of pages from the cache but also—through high-precision execution timing—the determination of whether a page was cached prior to the call. This effectively transmutes a deletion command into a conduit for information leakage.

Furthermore, the authors successfully bypassed the Linux kernel’s read-ahead mechanism, which preemptively loads anticipated pages. This was achieved through two strategies: reading files in reverse order and utilizing the readahead system call, which permits granular control over cache population without triggering automated preloading.

To monitor cache residency without incurring a load, the researchers employed the preadv2 system call with the RWF_NOWAIT flag, which returns an error if the requested page is absent from memory. Another mechanism, cachestat—introduced in Linux kernel 6.5—was deemed vulnerable and assigned the identifier CVE-2025-21691. Following proactive disclosure to the kernel development team, this vulnerability was remediated in early 2025.

Nevertheless, the primary mechanisms—posix_fadvise and preadv2—remain fundamentally unguarded. Restricting them risks compromising backward compatibility, which complicates the implementation of defensive measures. Paradoxically, these very calls facilitate the most precise and resilient methods of side-channel analysis.

The authors demonstrated that these techniques can be leveraged to establish covert communication channels between isolated processes, detect activity within Docker containers, identify browser events, and assault authentication interfaces. Such findings challenge not only the sanctity of user data but also the security of strictly isolated environments. This research underscores an exigent need to re-evaluate architectural decisions in modern operating systems; as these attacks require no elevated privileges, defensive paradigms must adapt to confront these non-traditional threats.