CVE-2025-38386 — Use After Free in Linux
CWE-416 — Use After FreeCWE-628 — Function Call with Incorrectly Specified Arguments67 documents8 sources
Severity
5.5MEDIUMNVD
OSV5.6OSV3.2
EPSS
0.0%
top 95.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 25
Latest updateMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Refuse to evaluate a method if arguments are missing
As reported in [1], a platform firmware update that increased the number
of method parameters and forgot to update a least one of its callers,
caused ACPICA to crash due to use-after-free.
Since this a result of a clear AML issue that arguably cannot be fixed
up by the interpreter (it cannot produce missing data out of thin air),
address it by making ACPICA refuse t…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages4 packages
▶CVEListV5linux/linux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 — b49d224d1830c46e20adce2a239c454cdab426f1+8
Also affects: Debian Linux 11.0