Null Dereference Vulnerability in Linux Kernel Affecting Acct System Call

CVE-2025-21846

What is CVE-2025-21846?

A vulnerability in the Linux kernel's acct system call can lead to a null dereference condition. This occurs when the system call is triggered to write to a file that executes an internal lookup, particularly when directed towards /sys/power/resume. If the calling task has already exited and called exit_fs(), this can result in a NULL dereference upon file access, as the current file system context becomes unreferenced. The code has been modified to ensure the final write operation is performed from the workqueue using the caller's credentials to mitigate this issue. It is recommended that this API be deprecated to avoid such security risks.

References