Security readout for executives and security teams
Plain-English summary
A Linux ACPI interpreter flaw can cause a use-after-free when faulty firmware calls an AML method without all required arguments. The reported outcome is a kernel crash. The CVSS assessment indicates potentially broader confidentiality, integrity, and availability impact, but the supplied evidence does not confirm those outcomes.
Executive priority
Treat as a high-priority maintenance issue, especially for multi-user Linux fleets or systems recently receiving firmware updates. Accelerate normal kernel patching and investigate affected hardware, but current evidence does not justify an emergency response based on active exploitation.
Technical view
ACPICA previously evaluated AML methods even when callers supplied fewer arguments than declared. A firmware update introduced such a mismatch, leading to use-after-free. The Linux fix rejects method evaluation when required arguments are missing. CVSS 3.1 is 7.8, requiring local access and low privileges, with no user interaction.
Likely exposure
Exposure applies to Linux systems running affected kernels where platform firmware contains or introduces the malformed AML call pattern. Practical reachability is hardware- and firmware-dependent. The supplied version data is ambiguous, so organizations should validate distribution kernel packages and backports rather than relying only on upstream version numbers.
Exploitation context
CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. The documented trigger was a defective platform firmware update. CVSS classifies attack access as local with low privileges, but the bundle confirms a crash rather than demonstrated privilege escalation or code execution.
Researcher notes
The security boundary and reliable trigger conditions remain incompletely documented in the supplied material. Analysis should distinguish upstream versions from distribution backports and correlate failures with firmware AML changes. The fix is defensive argument-count validation; the underlying firmware defect may remain. Avoid inferring arbitrary code execution from the use-after-free without additional evidence.
Mitigation direction
- Install distribution or vendor kernel updates containing the referenced ACPICA fix.
- Confirm custom kernels include the applicable stable-branch patch or an equivalent backport.
- Review hardware-vendor guidance for firmware versions containing malformed AML method calls.
- Prioritize exposed multi-user systems while assessing firmware-specific reachability.
Validation and detection
- Inventory running kernel versions, distribution package revisions, hardware models, and firmware versions.
- Verify the installed kernel package documents CVE-2025-38386 remediation or includes an equivalent backport.
- Check kernel and crash logs for ACPICA failures or use-after-free reports following firmware updates.
- Test applicable firmware and patched kernels in staging before broad deployment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38386 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b49d224d1830c46e20adce2a239c454cdab426f1CVE reference, Linux
- https://git.kernel.org/stable/c/2219e49857ffd6aea1b1ca5214d3270f84623a16CVE reference, Linux
- https://git.kernel.org/stable/c/ab1e8491c19eb2ea0fda81ef28e841c7cb6399f5CVE reference, Linux
- https://git.kernel.org/stable/c/4305d936abde795c2ef6ba916de8f00a50f64d2dCVE reference, Linux
- https://git.kernel.org/stable/c/d547779e72cea9865b732cd45393c4cd02b3598eCVE reference, Linux
- https://git.kernel.org/stable/c/18ff4ed6a33a7e3f2097710eacc96bea7696e803CVE reference, Linux
- https://git.kernel.org/stable/c/c9e4da550ae196132b990bd77ed3d8f2d9747f87CVE reference, Linux
- https://git.kernel.org/stable/c/6fcab2791543924d438e7fa49276d0998b0a069fCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.