CVE-2025-21846
MEDIUMLinux Kernel - NULL Pointer Dereference in acct(2) System Call
Title source: llmDescription
In the Linux kernel, the following vulnerability has been resolved: acct: perform last write from workqueue In [1] it was reported that the acct(2) system call can be used to trigger NULL deref in cases where it is set to write to a file that triggers an internal lookup. This can e.g., happen when pointing acc(2) to /sys/power/resume. At the point the where the write to this file happens the calling task has already exited and called exit_fs(). A lookup will thus trigger a NULL-deref when accessing current->fs. Reorganize the code so that the the final write happens from the workqueue but with the caller's credentials. This preserves the (strange) permission model and has almost no regression risk. This api should stop to exist though.
References (11)
Core 11
Core References
Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-265688.html
Scores
CVSS v3
5.5
EPSS
0.0021
EPSS Percentile
11.2%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-476
Status
published
Products (27)
linux/Kernel
2.6.12 - 5.4.291linux
linux/Kernel
5.11.0 - 5.15.179linux
linux/Kernel
5.16.0 - 6.1.130linux
linux/Kernel
5.5.0 - 5.10.235linux
linux/Kernel
6.13.0 - 6.13.5linux
linux/Kernel
6.2.0 - 6.6.80linux
linux/Kernel
6.7.0 - 6.12.17linux
Linux/Linux
< 2.6.12
Linux/Linux
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 - 56d5f3eba3f5de0efdd556de4ef381e109b973a9
Linux/Linux
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 - 5a59ced8ffc71973d42c82484a719c8f6ac8f7f7
... and 17 more
Published
Mar 12, 2025
Tracked Since
Feb 18, 2026