5.5

CVE-2025-38386

ACPICA: Refuse to evaluate a method if arguments are missing

In the Linux kernel, the following vulnerability has been resolved:

ACPICA: Refuse to evaluate a method if arguments are missing

As reported in [1], a platform firmware update that increased the number
of method parameters and forgot to update a least one of its callers,
caused ACPICA to crash due to use-after-free.

Since this a result of a clear AML issue that arguably cannot be fixed
up by the interpreter (it cannot produce missing data out of thin air),
address it by making ACPICA refuse to evaluate a method if the caller
attempts to pass fewer arguments than expected to it.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version < 5.4.296
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.240
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.187
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.144
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.97
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.37
Linux ≫ Linux Kernel Version >= 6.13 < 6.15.6
Linux ≫ Linux Kernel Version6.16 Updaterc1
Linux ≫ Linux Kernel Version6.16 Updaterc2
Debian ≫ Debian Linux Version11.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.061
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/18ff4ed6a33a7e3f2097710eacc96bea7696e803
Patch
https://git.kernel.org/stable/c/2219e49857ffd6aea1b1ca5214d3270f84623a16
Patch
https://git.kernel.org/stable/c/4305d936abde795c2ef6ba916de8f00a50f64d2d
Patch
https://git.kernel.org/stable/c/6fcab2791543924d438e7fa49276d0998b0a069f
Patch
https://git.kernel.org/stable/c/ab1e8491c19eb2ea0fda81ef28e841c7cb6399f5
Patch
https://git.kernel.org/stable/c/b49d224d1830c46e20adce2a239c454cdab426f1
Patch
https://git.kernel.org/stable/c/c9e4da550ae196132b990bd77ed3d8f2d9747f87
Patch
https://git.kernel.org/stable/c/d547779e72cea9865b732cd45393c4cd02b3598e
Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
Third Party Advisory