CVE-2025-21846

Summary

CVE-2025-21846 is a vulnerability affecting the Linux kernel's acct(2) system call. When this call is used to write to a specific file, such as /sys/power/resume, it can result in a NULL dereference if the calling task has already exited and called exit_fs(). This issue arises because the final write operation takes place after the calling task has exited, causing a lookup to result in a NULL dereference when trying to access the current task's file system (current->fs). To address this vulnerability, the code has been modified to perform the final write from a workqueue using the caller's credentials, thus preserving the odd permission model with minimal regression risk. It is recommended that this API be phased out in future releases.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.