CVE-2025-21846

MEDIUM

Linux Kernel - NULL Pointer Dereference in acct(2) System Call

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: acct: perform last write from workqueue In [1] it was reported that the acct(2) system call can be used to trigger NULL deref in cases where it is set to write to a file that triggers an internal lookup. This can e.g., happen when pointing acc(2) to /sys/power/resume. At the point the where the write to this file happens the calling task has already exited and called exit_fs(). A lookup will thus trigger a NULL-deref when accessing current->fs. Reorganize the code so that the the final write happens from the workqueue but with the caller's credentials. This preserves the (strange) permission model and has almost no regression risk. This api should stop to exist though.

Scores

CVSS v3 5.5
EPSS 0.0021
EPSS Percentile 11.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-476
Status published
Products (27)
linux/Kernel 2.6.12 - 5.4.291linux
linux/Kernel 5.11.0 - 5.15.179linux
linux/Kernel 5.16.0 - 6.1.130linux
linux/Kernel 5.5.0 - 5.10.235linux
linux/Kernel 6.13.0 - 6.13.5linux
linux/Kernel 6.2.0 - 6.6.80linux
linux/Kernel 6.7.0 - 6.12.17linux
Linux/Linux < 2.6.12
Linux/Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 - 56d5f3eba3f5de0efdd556de4ef381e109b973a9
Linux/Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 - 5a59ced8ffc71973d42c82484a719c8f6ac8f7f7
... and 17 more
Published Mar 12, 2025
Tracked Since Feb 18, 2026