CVE-2025-21846
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A vulnerability in the Linux kernel's acct(2) system call can cause a NULL pointer dereference when writing to a file that triggers an internal lookup (e.g., /sys/power/resume) after the process has exited and called exit_fs().
Risk Assessment
An attacker could exploit this vulnerability to trigger a kernel panic, causing system crashes and potential data loss by invoking acct(2) with a specially crafted file path.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit that reorganizes the write to a workqueue). If updating is not possible, avoid using acct(2) with files that trigger lookups.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: acct: perform last write from workqueue In [1] it was reported that the acct(2) system call can be used to trigger NULL deref in cases where it is set to write to a file that triggers an internal lookup. This can e.g., happen when pointing acc(2) to /sys/power/resume. At the point the where the write to this file happens the calling task has already exited and called exit_fs(). A lookup will thus trigger a NULL-deref when accessing current->fs. Reorganize the code so that the the final write happens from the workqueue but with the caller's credentials. This preserves the (strange) permission model and has almost no regression risk. This api should stop to exist though.