linux-cve-announce - CVE-2025-38386: ACPICA: Refuse to evaluate a method if arguments are missing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025072506-CVE-2025-38386-0a8a@gregkh>
Date: Fri, 25 Jul 2025 14:55:17 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38386: ACPICA: Refuse to evaluate a method if arguments are missing

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ACPICA: Refuse to evaluate a method if arguments are missing

As reported in [1], a platform firmware update that increased the number
of method parameters and forgot to update a least one of its callers,
caused ACPICA to crash due to use-after-free.

Since this a result of a clear AML issue that arguably cannot be fixed
up by the interpreter (it cannot produce missing data out of thin air),
address it by making ACPICA refuse to evaluate a method if the caller
attempts to pass fewer arguments than expected to it.

The Linux kernel CVE team has assigned CVE-2025-38386 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.4.296 with commit b49d224d1830c46e20adce2a239c454cdab426f1
	Fixed in 5.10.240 with commit 2219e49857ffd6aea1b1ca5214d3270f84623a16
	Fixed in 5.15.187 with commit ab1e8491c19eb2ea0fda81ef28e841c7cb6399f5
	Fixed in 6.1.144 with commit 4305d936abde795c2ef6ba916de8f00a50f64d2d
	Fixed in 6.6.97 with commit d547779e72cea9865b732cd45393c4cd02b3598e
	Fixed in 6.12.37 with commit 18ff4ed6a33a7e3f2097710eacc96bea7696e803
	Fixed in 6.15.6 with commit c9e4da550ae196132b990bd77ed3d8f2d9747f87
	Fixed in 6.16-rc3 with commit 6fcab2791543924d438e7fa49276d0998b0a069f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38386
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/acpi/acpica/dsmethod.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b49d224d1830c46e20adce2a239c454cdab426f1
	https://git.kernel.org/stable/c/2219e49857ffd6aea1b1ca5214d3270f84623a16
	https://git.kernel.org/stable/c/ab1e8491c19eb2ea0fda81ef28e841c7cb6399f5
	https://git.kernel.org/stable/c/4305d936abde795c2ef6ba916de8f00a50f64d2d
	https://git.kernel.org/stable/c/d547779e72cea9865b732cd45393c4cd02b3598e
	https://git.kernel.org/stable/c/18ff4ed6a33a7e3f2097710eacc96bea7696e803
	https://git.kernel.org/stable/c/c9e4da550ae196132b990bd77ed3d8f2d9747f87
	https://git.kernel.org/stable/c/6fcab2791543924d438e7fa49276d0998b0a069f