The suspects, who range in age from 11 to 18, were "school leavers and dropouts," Kuala Lumpur Police Chief Datuk Amar Singh Ishar Singh said Saturday during a news conference. They were arrested by Royal Malaysian Police, Bernama reported.
The investigation into the fire's cause continues, Singh said.
Witnesses reported being awoken Thursday by cries for help from inside the burning building, where children appeared trapped by metal window grills.
"I saw children kicking on the grill, but they couldn't get out. My friends and I rushed over and tried to reach them, but we couldn't get in," Shahirman Shahril told CNN.
When emergency responders arrived, "almost 90% of the building was already on fire," a fire and rescue department official told reporters.
"The firemen could hear cries for help from inside the building," spokesman Soiman Jahid said. "The first team from (the) fire station managed to save five of the children from the lower level."
Four people suffered serious injuries in the blaze. At least two other students and a member of the public were also injured, said Dr. S. Subramaniam, Malaysia's health minister.
Children tried to kick open window grills
Firefighters found badly burned bodies in three locations, Jahid said. Many victims found were piled on top of each other, while another was discovered in front of the main door.
"Based on my observation, the building has grills that could not be opened from inside," he said. "Because of the grills, they could not escape through the windows, except for the five students who escaped through the door and sought help from the firemen."
One of two fire exits in the building had been blocked by renovations taking place on the second floor, Jahid told CNN. Photos from the scene show fire damage to the top floor of the three-story Darul Quran Ittifaqiyah Tahfiz school.
Investigators were examining whether an electric short circuit had caused the fire, Deputy Inspector General of Police Noor Rashid Ibraham said.
Identifying the victims could take days, Subramaniam told reporters at Kuala Lumpur General Hospital.
"The bodies suffered severe burns to the point that it is difficult to confirm the identities," he said.
Norhayati Khalid was on her way to hospital to identify a body believed to be her son, 11-year-old Amin Ashraf. She'd last seen him a day earlier, she said
"I brought him some chicken floss buns, (and) my son passed me a handwritten note to say he's happy here at the school and he wants to be a 'hafiz' (someone who memorizes the Quran) so that he can take us to heaven," she told CNN.
"We moved him here three months ago from Kelantan, and it's a popular school among the students and teachers," she said. "We didn't have to pay any school fees."
The victims were between 13 and 17 years old, Ibraham said. Asked about younger victims, he said DNA testing would be required.
School shouldn't have been open, official says
The building where the fire erupted was new and had been used as a religious school specializing in Quranic studies, Ibraham said.
But the school's license had been under review by authorities, and the facility should not have been in operation, said Malaysia's minister of urban well-being, housing and local government, Noh Omar.
There have been 29 similar incidents in the past involving fires at religious schools, Noh told reporters. He did not specify a timeframe.
Malaysian Prime Minister Najib Razak expressed his sympathy for those affected.
"Deeply saddened to hear Darul Quran Ittifaqiyah Tahfiz Center burned and that more than 20 lives were lost," he tweeted. "May their souls be blessed by Allah SWT. Al Fatihah."
Malaysian media earlier reported that 25 people were killed, 23 students and two wardens.