Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2025-21846 is a medium-severity NULL Pointer Dereference (CWE-476) vulnerability in Linux Linux Kernel. Its CVSS base score is 5.5 (Medium).
Operationally, ranked at the 13th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-16 (Memory Protection) and CM-7 (Least Functionality) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6290
Vulnerability Data
In the Linux kernel, the following vulnerability has been resolved: acct: perform last write from workqueue In [1] it was reported that the acct(2) system call can be used to trigger NULL deref in cases where it is set to…
more
write to a file that triggers an internal lookup. This can e.g., happen when pointing acc(2) to /sys/power/resume. At the point the where the write to this file happens the calling task has already exited and called exit_fs(). A lookup will thus trigger a NULL-deref when accessing current->fs. Reorganize the code so that the the final write happens from the workqueue but with the caller's credentials. This preserves the (strange) permission model and has almost no regression risk. This api should stop to exist though.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CWE-476 NULL pointer dereference in kernel paths such as acct(2) by enforcing memory protections that block invalid dereferences.
Process isolation limits the blast radius when a NULL dereference occurs in the accounting subsystem after exit_fs().
Disabling or restricting the acct(2) interface when not required eliminates the attack surface that triggers the kernel lookup after task exit.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices (static analysis, code review, safe coding standards) directly prevent NULL dereference bugs during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect NULL dereference defects before release.
Secure SDLC mandates defensive coding practices that can prevent NULL dereferences.
Application security requirements can specify input validation and pointer-safety rules.
Secure architecture principles encourage defensive design that avoids unsafe pointer use.
Secure coding standards directly require NULL-pointer checks and safe dereference patterns.