CVE-2025-21846 | acct: perform last write from workqueue

In the Linux kernel, the following vulnerability has been resolved: acct: perform last write from workqueue In [1] it was reported that the acct(2) system call can be used to trigger NULL deref in cases where it is set to write to a file that triggers an internal lookup. This can e.g., happen when pointing acc(2) to /sys/power/resume. At the point the where the write to this file happens the calling task has already exited and called exit_fs(). A lookup will thus trigger a NULL-deref when accessing current->fs. Reorganize the code so that the the final write happens from the workqueue but with the caller's credentials. This preserves the (strange) permission model and has almost no regression risk. This api should stop to exist though.

Published: 2025-03-12 Last update: 2026-05-12 Assigner: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2025-21846 is rated Low Risk (26.9/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.05%). Monitor for updates and reassess as exploit intelligence or EPSS changes.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2025-21846

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2025-12-28 0.06% 0.05% -0.01%
2 2025-12-27 0.04% 0.06% +0.02%
3 2025-10-28 — 0.04% —

Full EPSS history (7 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2025-21846

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
5.5 3.1 MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Click to expand
Attack vector (AV:L)
They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 1.8 3.6 [email protected]
5.5 3.1 MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Click to expand
Attack vector (AV:L)
They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 1.8 3.6 134c704f-9b21-4f2e-91b3-4a467353bcc0

Weakness enumeration for CVE-2025-21846

GitHub Security Advisory for CVE-2025-21846

GHSA-wg7v-626p-h26r · Severity: medium — In the Linux kernel, the following vulnerability has been resolved: acct: perform last write...

OS Trackers for CVE-2025-21846

vendor priority summary link
debian not yet assigned CVE-2025-21846 not yet assigned priority: Debian including 2 source packages (linux, linux-6.1), 6 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 6. https://security-tracker.debian.org/tracker/CVE-2025-21846
redhat medium — https://access.redhat.com/security/cve/CVE-2025-21846
suse medium — https://www.suse.com/security/cve/CVE-2025-21846/
ubuntu medium CVE-2025-21846 medium priority: Ubuntu including 158 source packages (linux, linux-allwinner-5.19, …), 1551 status rows across 10 suites (bionic, focal, jammy, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 1145, released 189, ignored 154, not-affected 43, needed 20. https://ubuntu.com/security/CVE-2025-21846

Affected software / configurations for CVE-2025-21846

Vendor Product Version Raw CPE
linux linux_kernel >= 2.6.12, < 6.1.130 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 6.2, < 6.6.80 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 6.7, < 6.12.17 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 6.13, < 6.13.5 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel 6.14 cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
linux linux_kernel 6.14 cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
linux linux_kernel 6.14 cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*

References for CVE-2025-21846

URL Tags
https://git.kernel.org/stable/c/56d5f3eba3f5de0efdd556de4ef381e109b973a9 Patch
https://git.kernel.org/stable/c/5a59ced8ffc71973d42c82484a719c8f6ac8f7f7 Patch
https://git.kernel.org/stable/c/5c928e14a2ccd99462f2351ead627b58075bb736 Patch
https://git.kernel.org/stable/c/5d5b936cfa4b0d5670ca7420ef165a074bc008eb Patch
https://git.kernel.org/stable/c/5ee8da9bea70dda492d61f075658939af33d8410 Patch
https://git.kernel.org/stable/c/8acbf4a88c6a98c8ed00afd1a7d1abcca9b4735e Patch
https://git.kernel.org/stable/c/a8136afca090412a36429cb6c2543c714d9c0f84 Patch
https://git.kernel.org/stable/c/b03782ae707cc45e65242c7cddd8e28f1c22cde5 Patch
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html
https://cert-portal.siemens.com/productcert/html/ssa-265688.html
cvelogic Threat Intelligence