ACPICA Method Argument Vulnerability in Linux Kernel
Summary
CVE-2025-38386: In the Linux kernel, the following vulnerability has been resolved: ACPICA: Refuse to evaluate a method if arguments are missing As reported in [1], a platform firmware update that increased the number of method paramete... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used in various distributions, including Debian. The kernel's functionality includes process management, memory management, device drivers, and system calls. This vulnerability specifically affects the ACPICA (ACPI Component Architecture) within the kernel, which is responsible for interpreting ACPI (Advanced Configuration and Power Interface) methods. A flaw in the method argument handling can lead to system crashes and instability.
Vulnerability Detail
The vulnerability, identified as CVE-2025-38386, arises from a flaw in the ACPICA component of the Linux kernel. It occurs when a platform firmware update increases the number of method parameters without updating all of its callers, leading to a use-after-free condition. This can cause ACPICA to crash, resulting in potential system instability and data loss. The issue is rooted in the inability of the interpreter to handle missing data for method calls, making it a critical concern for systems relying on ACPI for hardware management.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2025-38386 is a significant vulnerability in the Linux kernel's ACPICA component, which can lead to system crashes due to improper method argument handling. Users are advised to update their systems to the latest patched version to ensure stability and security. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system integrity.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38386 is a vulnerability in the Linux kernel's ACPICA component that can cause system crashes due to improper handling of method arguments.
This vulnerability can lead to system instability and crashes, particularly in environments that rely on ACPI for hardware management.
The vulnerability affects Debian versions 11, 12, and 13. Users should check their kernel version and update if necessary.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
