Junglewise Threat Intelligence

CVE-2025-21846: Linux Kernel NULL pointer dereference in acct system call

CVE-2025-21846 · Severity: medium · CVSS 5.5 · Published 2025-03-12

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's process accounting system could allow a local user to crash the operating system. The issue occurs when the system attempts to write accounting data to specific system files after a process has already finished exiting. This results in a system crash (NULL pointer dereference), potentially leading to a denial of service for all users and applications on the affected machine.

Technical details

A NULL pointer dereference exists in the Linux kernel's BSD process accounting implementation (kernel/acct.c). The vulnerability is triggered when the acct(2) system call is configured to write to a file that requires an internal path lookup (such as /sys/power/resume). Because the final write operation can occur after the calling task has invoked exit_fs(), the task's filesystem context (current->fs) is NULL. When the kernel attempts a lookup during this write, it dereferences the NULL pointer. The fix reorganizes the code to perform the final write from a workqueue using the caller's credentials, ensuring the filesystem context is handled correctly. Patches have been released for multiple stable kernel branches.

Affected products

  • Linux Linux Kernel versions from 2.6.12 to 6.1.130, 6.2 to 6.6.80, 6.7 to 6.12.17, 6.13 to 6.13.5, and 6.14-rc1 through 6.14-rc3

Timeline

  • 2025-03-12: disclosed: Initial disclosure of CVE-2025-21846
  • 2025-03-12: advisory
  • 2025-02-11: patched: Initial patch authored by Christian Brauner

References

Related threats