High 7.8Published Jul 25, 2025

CVE-2025-38386ACPICA: Refuse to evaluate a method if arguments are missing

Updated under an hour ago (Oct 27, 2026, 2:10 PM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Refuse to evaluate a method if arguments are missing As reported in [1], a platform firmware update that increased the number of method parameters and forgot to update a least one of its callers, caused ACPICA to crash due to use-after-free. Since this a result of a clear AML issue that arguably cannot be fixed up by the interpreter (it cannot produce missing data out of thin air), address it by making ACPICA refuse to evaluate a method if the caller attempts to pass fewer arguments than expected to it.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before b49d224d1830c46e20adce2a239c454cdab426f1; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 2219e49857ffd6aea1b1ca5214d3270f84623a16; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before ab1e8491c19eb2ea0fda81ef28e841c7cb6399f5; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 4305d936abde795c2ef6ba916de8f00a50f64d2d; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before d547779e72cea9865b732cd45393c4cd02b3598e; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 18ff4ed6a33a7e3f2097710eacc96bea7696e803; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c9e4da550ae196132b990bd77ed3d8f2d9747f87; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 6fcab2791543924d438e7fa49276d0998b0a069f	CNA record
linux linux_kernel linux:linux_kernel	before 5.4.296; from 5.5 before 5.10.240; from 5.11 before 5.15.187; from 5.16 before 6.1.144; from 6.2 before 6.6.97; from 6.7 before 6.12.37; from 6.13 before 6.15.6; 6.16; and 1 more ranges	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

References

https://git.kernel.org/stable/c/b49d224d1830c46e20adce2a239c454cdab426f1	patch
https://git.kernel.org/stable/c/2219e49857ffd6aea1b1ca5214d3270f84623a16	patch
https://git.kernel.org/stable/c/ab1e8491c19eb2ea0fda81ef28e841c7cb6399f5	patch
https://git.kernel.org/stable/c/4305d936abde795c2ef6ba916de8f00a50f64d2d	patch
https://git.kernel.org/stable/c/d547779e72cea9865b732cd45393c4cd02b3598e	patch
https://git.kernel.org/stable/c/18ff4ed6a33a7e3f2097710eacc96bea7696e803	patch
https://git.kernel.org/stable/c/c9e4da550ae196132b990bd77ed3d8f2d9747f87	patch
https://git.kernel.org/stable/c/6fcab2791543924d438e7fa49276d0998b0a069f	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html	third-party-advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.