GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38344 (GCVE-0-2025-38344)

Vulnerability from cvelistv5 – Published: 2025-07-10 08:15 – Updated: 2026-05-11 21:26
VLAI
Title
ACPICA: fix acpi parse and parseext cache leaks
Summary
In the Linux kernel, the following vulnerability has been resolved: ACPICA: fix acpi parse and parseext cache leaks ACPICA commit 8829e70e1360c81e7a5a901b5d4f48330e021ea5 I'm Seunghun Han, and I work for National Security Research Institute of South Korea. I have been doing a research on ACPI and found an ACPI cache leak in ACPI early abort cases. Boot log of ACPI cache leak is as follows: [ 0.352414] ACPI: Added _OSI(Module Device) [ 0.353182] ACPI: Added _OSI(Processor Device) [ 0.353182] ACPI: Added _OSI(3.0 _SCP Extensions) [ 0.353182] ACPI: Added _OSI(Processor Aggregator Device) [ 0.356028] ACPI: Unable to start the ACPI Interpreter [ 0.356799] ACPI Error: Could not remove SCI handler (20170303/evmisc-281) [ 0.360215] kmem_cache_destroy Acpi-State: Slab cache still has objects [ 0.360648] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 4.12.0-rc4-next-20170608+ #10 [ 0.361273] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 [ 0.361873] Call Trace: [ 0.362243] ? dump_stack+0x5c/0x81 [ 0.362591] ? kmem_cache_destroy+0x1aa/0x1c0 [ 0.362944] ? acpi_sleep_proc_init+0x27/0x27 [ 0.363296] ? acpi_os_delete_cache+0xa/0x10 [ 0.363646] ? acpi_ut_delete_caches+0x6d/0x7b [ 0.364000] ? acpi_terminate+0xa/0x14 [ 0.364000] ? acpi_init+0x2af/0x34f [ 0.364000] ? __class_create+0x4c/0x80 [ 0.364000] ? video_setup+0x7f/0x7f [ 0.364000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.364000] ? do_one_initcall+0x4e/0x1a0 [ 0.364000] ? kernel_init_freeable+0x189/0x20a [ 0.364000] ? rest_init+0xc0/0xc0 [ 0.364000] ? kernel_init+0xa/0x100 [ 0.364000] ? ret_from_fork+0x25/0x30 I analyzed this memory leak in detail. I found that “Acpi-State” cache and “Acpi-Parse” cache were merged because the size of cache objects was same slab cache size. I finally found “Acpi-Parse” cache and “Acpi-parse_ext” cache were leaked using SLAB_NEVER_MERGE flag in kmem_cache_create() function. Real ACPI cache leak point is as follows: [ 0.360101] ACPI: Added _OSI(Module Device) [ 0.360101] ACPI: Added _OSI(Processor Device) [ 0.360101] ACPI: Added _OSI(3.0 _SCP Extensions) [ 0.361043] ACPI: Added _OSI(Processor Aggregator Device) [ 0.364016] ACPI: Unable to start the ACPI Interpreter [ 0.365061] ACPI Error: Could not remove SCI handler (20170303/evmisc-281) [ 0.368174] kmem_cache_destroy Acpi-Parse: Slab cache still has objects [ 0.369332] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W 4.12.0-rc4-next-20170608+ #8 [ 0.371256] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 [ 0.372000] Call Trace: [ 0.372000] ? dump_stack+0x5c/0x81 [ 0.372000] ? kmem_cache_destroy+0x1aa/0x1c0 [ 0.372000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.372000] ? acpi_os_delete_cache+0xa/0x10 [ 0.372000] ? acpi_ut_delete_caches+0x56/0x7b [ 0.372000] ? acpi_terminate+0xa/0x14 [ 0.372000] ? acpi_init+0x2af/0x34f [ 0.372000] ? __class_create+0x4c/0x80 [ 0.372000] ? video_setup+0x7f/0x7f [ 0.372000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.372000] ? do_one_initcall+0x4e/0x1a0 [ 0.372000] ? kernel_init_freeable+0x189/0x20a [ 0.372000] ? rest_init+0xc0/0xc0 [ 0.372000] ? kernel_init+0xa/0x100 [ 0.372000] ? ret_from_fork+0x25/0x30 [ 0.388039] kmem_cache_destroy Acpi-parse_ext: Slab cache still has objects [ 0.389063] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W 4.12.0-rc4-next-20170608+ #8 [ 0.390557] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 [ 0.392000] Call Trace: [ 0.392000] ? dump_stack+0x5c/0x81 [ 0.392000] ? kmem_cache_destroy+0x1aa/0x1c0 [ 0.392000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.392000] ? acpi_os_delete_cache+0xa/0x10 [ 0.392000] ? acpi_ut_delete_caches+0x6d/0x7b [ 0.392000] ? acpi_terminate+0xa/0x14 [ 0.392000] ? acpi_init+0x2af/0x3 ---truncated---
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 88ac00f5a841dcfc5c682000f4a6add0add8caac , < 1e0e629e88b1f7751ce69bf70cda6d1598d45271 (git)
Affected: 88ac00f5a841dcfc5c682000f4a6add0add8caac , < 41afebc9a0762aafc35d2df88f4e1b798155a940 (git)
Affected: 88ac00f5a841dcfc5c682000f4a6add0add8caac , < 960236150cd3f08e13b397dd5ae4ccf7a2986c00 (git)
Affected: 88ac00f5a841dcfc5c682000f4a6add0add8caac , < 0a119fdaed67566aa3e0b5222dced4d08bbce463 (git)
Affected: 88ac00f5a841dcfc5c682000f4a6add0add8caac , < 1fee4324b5660de080cefc3fc91c371543bdb8f6 (git)
Affected: 88ac00f5a841dcfc5c682000f4a6add0add8caac , < 198c2dab022e5e94a99fff267b669d693bc7bb49 (git)
Affected: 88ac00f5a841dcfc5c682000f4a6add0add8caac , < 3e0c59180ec83bdec43b3d3482cff23d86d380d0 (git)
Affected: 88ac00f5a841dcfc5c682000f4a6add0add8caac , < bed18f0bdcd6737a938264a59d67923688696fc4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.14
Unaffected: 0 , < 2.6.14 (semver)
Unaffected: 5.4.295 , ≤ 5.4.* (semver)
Unaffected: 5.10.239 , ≤ 5.10.* (semver)
Unaffected: 5.15.186 , ≤ 5.15.* (semver)
Unaffected: 6.1.142 , ≤ 6.1.* (semver)
Unaffected: 6.6.95 , ≤ 6.6.* (semver)
Unaffected: 6.12.35 , ≤ 6.12.* (semver)
Unaffected: 6.15.4 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:36:51.372Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/acpi/acpica/psobject.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1e0e629e88b1f7751ce69bf70cda6d1598d45271",
              "status": "affected",
              "version": "88ac00f5a841dcfc5c682000f4a6add0add8caac",
              "versionType": "git"
            },
            {
              "lessThan": "41afebc9a0762aafc35d2df88f4e1b798155a940",
              "status": "affected",
              "version": "88ac00f5a841dcfc5c682000f4a6add0add8caac",
              "versionType": "git"
            },
            {
              "lessThan": "960236150cd3f08e13b397dd5ae4ccf7a2986c00",
              "status": "affected",
              "version": "88ac00f5a841dcfc5c682000f4a6add0add8caac",
              "versionType": "git"
            },
            {
              "lessThan": "0a119fdaed67566aa3e0b5222dced4d08bbce463",
              "status": "affected",
              "version": "88ac00f5a841dcfc5c682000f4a6add0add8caac",
              "versionType": "git"
            },
            {
              "lessThan": "1fee4324b5660de080cefc3fc91c371543bdb8f6",
              "status": "affected",
              "version": "88ac00f5a841dcfc5c682000f4a6add0add8caac",
              "versionType": "git"
            },
            {
              "lessThan": "198c2dab022e5e94a99fff267b669d693bc7bb49",
              "status": "affected",
              "version": "88ac00f5a841dcfc5c682000f4a6add0add8caac",
              "versionType": "git"
            },
            {
              "lessThan": "3e0c59180ec83bdec43b3d3482cff23d86d380d0",
              "status": "affected",
              "version": "88ac00f5a841dcfc5c682000f4a6add0add8caac",
              "versionType": "git"
            },
            {
              "lessThan": "bed18f0bdcd6737a938264a59d67923688696fc4",
              "status": "affected",
              "version": "88ac00f5a841dcfc5c682000f4a6add0add8caac",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/acpi/acpica/psobject.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.14"
            },
            {
              "lessThan": "2.6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.295",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.295",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.95",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "2.6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: fix acpi parse and parseext cache leaks\n\nACPICA commit 8829e70e1360c81e7a5a901b5d4f48330e021ea5\n\nI\u0027m Seunghun Han, and I work for National Security Research Institute of\nSouth Korea.\n\nI have been doing a research on ACPI and found an ACPI cache leak in ACPI\nearly abort cases.\n\nBoot log of ACPI cache leak is as follows:\n[    0.352414] ACPI: Added _OSI(Module Device)\n[    0.353182] ACPI: Added _OSI(Processor Device)\n[    0.353182] ACPI: Added _OSI(3.0 _SCP Extensions)\n[    0.353182] ACPI: Added _OSI(Processor Aggregator Device)\n[    0.356028] ACPI: Unable to start the ACPI Interpreter\n[    0.356799] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)\n[    0.360215] kmem_cache_destroy Acpi-State: Slab cache still has objects\n[    0.360648] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G        W\n4.12.0-rc4-next-20170608+ #10\n[    0.361273] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\nvirtual_box 12/01/2006\n[    0.361873] Call Trace:\n[    0.362243]  ? dump_stack+0x5c/0x81\n[    0.362591]  ? kmem_cache_destroy+0x1aa/0x1c0\n[    0.362944]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.363296]  ? acpi_os_delete_cache+0xa/0x10\n[    0.363646]  ? acpi_ut_delete_caches+0x6d/0x7b\n[    0.364000]  ? acpi_terminate+0xa/0x14\n[    0.364000]  ? acpi_init+0x2af/0x34f\n[    0.364000]  ? __class_create+0x4c/0x80\n[    0.364000]  ? video_setup+0x7f/0x7f\n[    0.364000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.364000]  ? do_one_initcall+0x4e/0x1a0\n[    0.364000]  ? kernel_init_freeable+0x189/0x20a\n[    0.364000]  ? rest_init+0xc0/0xc0\n[    0.364000]  ? kernel_init+0xa/0x100\n[    0.364000]  ? ret_from_fork+0x25/0x30\n\nI analyzed this memory leak in detail. I found that \u201cAcpi-State\u201d cache and\n\u201cAcpi-Parse\u201d cache were merged because the size of cache objects was same\nslab cache size.\n\nI finally found \u201cAcpi-Parse\u201d cache and \u201cAcpi-parse_ext\u201d cache were leaked\nusing SLAB_NEVER_MERGE flag in kmem_cache_create() function.\n\nReal ACPI cache leak point is as follows:\n[    0.360101] ACPI: Added _OSI(Module Device)\n[    0.360101] ACPI: Added _OSI(Processor Device)\n[    0.360101] ACPI: Added _OSI(3.0 _SCP Extensions)\n[    0.361043] ACPI: Added _OSI(Processor Aggregator Device)\n[    0.364016] ACPI: Unable to start the ACPI Interpreter\n[    0.365061] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)\n[    0.368174] kmem_cache_destroy Acpi-Parse: Slab cache still has objects\n[    0.369332] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W\n4.12.0-rc4-next-20170608+ #8\n[    0.371256] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\nvirtual_box 12/01/2006\n[    0.372000] Call Trace:\n[    0.372000]  ? dump_stack+0x5c/0x81\n[    0.372000]  ? kmem_cache_destroy+0x1aa/0x1c0\n[    0.372000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.372000]  ? acpi_os_delete_cache+0xa/0x10\n[    0.372000]  ? acpi_ut_delete_caches+0x56/0x7b\n[    0.372000]  ? acpi_terminate+0xa/0x14\n[    0.372000]  ? acpi_init+0x2af/0x34f\n[    0.372000]  ? __class_create+0x4c/0x80\n[    0.372000]  ? video_setup+0x7f/0x7f\n[    0.372000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.372000]  ? do_one_initcall+0x4e/0x1a0\n[    0.372000]  ? kernel_init_freeable+0x189/0x20a\n[    0.372000]  ? rest_init+0xc0/0xc0\n[    0.372000]  ? kernel_init+0xa/0x100\n[    0.372000]  ? ret_from_fork+0x25/0x30\n[    0.388039] kmem_cache_destroy Acpi-parse_ext: Slab cache still has objects\n[    0.389063] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W\n4.12.0-rc4-next-20170608+ #8\n[    0.390557] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\nvirtual_box 12/01/2006\n[    0.392000] Call Trace:\n[    0.392000]  ? dump_stack+0x5c/0x81\n[    0.392000]  ? kmem_cache_destroy+0x1aa/0x1c0\n[    0.392000]  ? acpi_sleep_proc_init+0x27/0x27\n[    0.392000]  ? acpi_os_delete_cache+0xa/0x10\n[    0.392000]  ? acpi_ut_delete_caches+0x6d/0x7b\n[    0.392000]  ? acpi_terminate+0xa/0x14\n[    0.392000]  ? acpi_init+0x2af/0x3\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:26:10.671Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1e0e629e88b1f7751ce69bf70cda6d1598d45271"
        },
        {
          "url": "https://git.kernel.org/stable/c/41afebc9a0762aafc35d2df88f4e1b798155a940"
        },
        {
          "url": "https://git.kernel.org/stable/c/960236150cd3f08e13b397dd5ae4ccf7a2986c00"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a119fdaed67566aa3e0b5222dced4d08bbce463"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fee4324b5660de080cefc3fc91c371543bdb8f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/198c2dab022e5e94a99fff267b669d693bc7bb49"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e0c59180ec83bdec43b3d3482cff23d86d380d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/bed18f0bdcd6737a938264a59d67923688696fc4"
        }
      ],
      "title": "ACPICA: fix acpi parse and parseext cache leaks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38344",
    "datePublished": "2025-07-10T08:15:12.791Z",
    "dateReserved": "2025-04-16T04:51:24.006Z",
    "dateUpdated": "2026-05-11T21:26:10.671Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38344",
      "date": "2026-09-16",
      "epss": "0.0017",
      "percentile": "0.06749"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T15:06:09.000Z",
      "cve": "CVE-2025-38344",
      "id": "msrc_CVE-2025-38344",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ACPICA: fix acpi parse and parseext cache leaks",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38344.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38344\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-10T09:15:29.283\",\"lastModified\":\"2026-06-17T09:16:39.913\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nACPICA: fix acpi parse and parseext cache leaks\\n\\nACPICA commit 8829e70e1360c81e7a5a901b5d4f48330e021ea5\\n\\nI\u0027m Seunghun Han, and I work for National Security Research Institute of\\nSouth Korea.\\n\\nI have been doing a research on ACPI and found an ACPI cache leak in ACPI\\nearly abort cases.\\n\\nBoot log of ACPI cache leak is as follows:\\n[    0.352414] ACPI: Added _OSI(Module Device)\\n[    0.353182] ACPI: Added _OSI(Processor Device)\\n[    0.353182] ACPI: Added _OSI(3.0 _SCP Extensions)\\n[    0.353182] ACPI: Added _OSI(Processor Aggregator Device)\\n[    0.356028] ACPI: Unable to start the ACPI Interpreter\\n[    0.356799] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)\\n[    0.360215] kmem_cache_destroy Acpi-State: Slab cache still has objects\\n[    0.360648] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G        W\\n4.12.0-rc4-next-20170608+ #10\\n[    0.361273] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\\nvirtual_box 12/01/2006\\n[    0.361873] Call Trace:\\n[    0.362243]  ? dump_stack+0x5c/0x81\\n[    0.362591]  ? kmem_cache_destroy+0x1aa/0x1c0\\n[    0.362944]  ? acpi_sleep_proc_init+0x27/0x27\\n[    0.363296]  ? acpi_os_delete_cache+0xa/0x10\\n[    0.363646]  ? acpi_ut_delete_caches+0x6d/0x7b\\n[    0.364000]  ? acpi_terminate+0xa/0x14\\n[    0.364000]  ? acpi_init+0x2af/0x34f\\n[    0.364000]  ? __class_create+0x4c/0x80\\n[    0.364000]  ? video_setup+0x7f/0x7f\\n[    0.364000]  ? acpi_sleep_proc_init+0x27/0x27\\n[    0.364000]  ? do_one_initcall+0x4e/0x1a0\\n[    0.364000]  ? kernel_init_freeable+0x189/0x20a\\n[    0.364000]  ? rest_init+0xc0/0xc0\\n[    0.364000]  ? kernel_init+0xa/0x100\\n[    0.364000]  ? ret_from_fork+0x25/0x30\\n\\nI analyzed this memory leak in detail. I found that \u201cAcpi-State\u201d cache and\\n\u201cAcpi-Parse\u201d cache were merged because the size of cache objects was same\\nslab cache size.\\n\\nI finally found \u201cAcpi-Parse\u201d cache and \u201cAcpi-parse_ext\u201d cache were leaked\\nusing SLAB_NEVER_MERGE flag in kmem_cache_create() function.\\n\\nReal ACPI cache leak point is as follows:\\n[    0.360101] ACPI: Added _OSI(Module Device)\\n[    0.360101] ACPI: Added _OSI(Processor Device)\\n[    0.360101] ACPI: Added _OSI(3.0 _SCP Extensions)\\n[    0.361043] ACPI: Added _OSI(Processor Aggregator Device)\\n[    0.364016] ACPI: Unable to start the ACPI Interpreter\\n[    0.365061] ACPI Error: Could not remove SCI handler (20170303/evmisc-281)\\n[    0.368174] kmem_cache_destroy Acpi-Parse: Slab cache still has objects\\n[    0.369332] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W\\n4.12.0-rc4-next-20170608+ #8\\n[    0.371256] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\\nvirtual_box 12/01/2006\\n[    0.372000] Call Trace:\\n[    0.372000]  ? dump_stack+0x5c/0x81\\n[    0.372000]  ? kmem_cache_destroy+0x1aa/0x1c0\\n[    0.372000]  ? acpi_sleep_proc_init+0x27/0x27\\n[    0.372000]  ? acpi_os_delete_cache+0xa/0x10\\n[    0.372000]  ? acpi_ut_delete_caches+0x56/0x7b\\n[    0.372000]  ? acpi_terminate+0xa/0x14\\n[    0.372000]  ? acpi_init+0x2af/0x34f\\n[    0.372000]  ? __class_create+0x4c/0x80\\n[    0.372000]  ? video_setup+0x7f/0x7f\\n[    0.372000]  ? acpi_sleep_proc_init+0x27/0x27\\n[    0.372000]  ? do_one_initcall+0x4e/0x1a0\\n[    0.372000]  ? kernel_init_freeable+0x189/0x20a\\n[    0.372000]  ? rest_init+0xc0/0xc0\\n[    0.372000]  ? kernel_init+0xa/0x100\\n[    0.372000]  ? ret_from_fork+0x25/0x30\\n[    0.388039] kmem_cache_destroy Acpi-parse_ext: Slab cache still has objects\\n[    0.389063] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W\\n4.12.0-rc4-next-20170608+ #8\\n[    0.390557] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS\\nvirtual_box 12/01/2006\\n[    0.392000] Call Trace:\\n[    0.392000]  ? dump_stack+0x5c/0x81\\n[    0.392000]  ? kmem_cache_destroy+0x1aa/0x1c0\\n[    0.392000]  ? acpi_sleep_proc_init+0x27/0x27\\n[    0.392000]  ? acpi_os_delete_cache+0xa/0x10\\n[    0.392000]  ? acpi_ut_delete_caches+0x6d/0x7b\\n[    0.392000]  ? acpi_terminate+0xa/0x14\\n[    0.392000]  ? acpi_init+0x2af/0x3\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ACPICA: se corrigen las fugas de cach\u00e9 de ACPI parse y parseext. Confirmaci\u00f3n de ACPICA 8829e70e1360c81e7a5a901b5d4f48330e021ea5. Soy Seunghun Han y trabajo para el Instituto de Investigaci\u00f3n de Seguridad Nacional de Corea del Sur. He estado investigando sobre ACPI y he encontrado una fuga de cach\u00e9 en casos de aborto temprano de ACPI. El registro de arranque de la p\u00e9rdida de cach\u00e9 ACPI es el siguiente: [0.352414] ACPI: _OSI(Dispositivo de m\u00f3dulo) a\u00f1adido [0.353182] ACPI: _OSI(Dispositivo de procesador) a\u00f1adido [0.353182] ACPI: _OSI(Extensiones 3.0 _SCP) a\u00f1adido [0.353182] ACPI: _OSI(Dispositivo agregador de procesador) a\u00f1adido [0.356028] ACPI: No se puede iniciar el int\u00e9rprete ACPI [0.356799] Error ACPI: No se pudo eliminar el controlador SCI (20170303/evmisc-281) [0.360215] kmem_cache_destroy Estado Acpi: La cach\u00e9 Slab todav\u00eda tiene objetos [0.360648] CPU: 0 PID: 1 Comm: swapper/0 Contaminado: GW 4.12.0-rc4-next-20170608+ #10 [ 0.361273] Nombre del hardware: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 [ 0.361873] Rastreo de llamadas: [ 0.362243] ? dump_stack+0x5c/0x81 [ 0.362591] ? kmem_cache_destroy+0x1aa/0x1c0 [ 0.362944] ? acpi_sleep_proc_init+0x27/0x27 [ 0.363296] ? acpi_os_delete_cache+0xa/0x10 [ 0.363646] ? acpi_ut_delete_caches+0x6d/0x7b [ 0.364000] ? acpi_terminate+0xa/0x14 [ 0.364000] ? acpi_init+0x2af/0x34f [ 0.364000] ? __class_create+0x4c/0x80 [ 0.364000] ? video_setup+0x7f/0x7f [ 0.364000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.364000] ? do_one_initcall+0x4e/0x1a0 [ 0.364000] ? kernel_init_freeable+0x189/0x20a [ 0.364000] ? rest_init+0xc0/0xc0 [ 0.364000] ? kernel_init+0xa/0x100 [ 0.364000] ? ret_from_fork+0x25/0x30 Analic\u00e9 esta fuga de memoria en detalle. Descubr\u00ed que las cach\u00e9s \\\"Acpi-State\\\" y \\\"Acpi-Parse\\\" se fusionaron porque el tama\u00f1o de los objetos de la cach\u00e9 era el mismo que el de la cach\u00e9 slab. Finalmente, descubr\u00ed que las cach\u00e9s \\\"Acpi-Parse\\\" y \\\"Acpi-parse_ext\\\" se filtraron mediante el indicador SLAB_NEVER_MERGE de la funci\u00f3n kmem_cache_create(). El punto de fuga de cach\u00e9 ACPI real es el siguiente: [0.360101] ACPI: _OSI(Dispositivo de m\u00f3dulo) a\u00f1adido [0.360101] ACPI: _OSI(Dispositivo de procesador) a\u00f1adido [0.360101] ACPI: _OSI(Extensiones 3.0 _SCP) a\u00f1adido [0.361043] ACPI: _OSI(Dispositivo agregador de procesador) a\u00f1adido [0.364016] ACPI: No se puede iniciar el int\u00e9rprete ACPI [0.365061] Error ACPI: No se pudo eliminar el controlador SCI (20170303/evmisc-281) [0.368174] kmem_cache_destroy Acpi-Parse: La cach\u00e9 Slab a\u00fan tiene objetos [0.369332] CPU: 1 PID: 1 Comm: swapper/0 Contaminado: GW 4.12.0-rc4-next-20170608+ #8 [ 0.371256] Nombre del hardware: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 [ 0.372000] Rastreo de llamadas: [ 0.372000] ? dump_stack+0x5c/0x81 [ 0.372000] ? kmem_cache_destroy+0x1aa/0x1c0 [ 0.372000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.372000] ? acpi_os_delete_cache+0xa/0x10 [ 0.372000] ? acpi_ut_delete_caches+0x56/0x7b [0.372000] ? acpi_terminate+0xa/0x14 [0.372000] ? acpi_init+0x2af/0x34f [0.372000] ? __class_create+0x4c/0x80 [0.372000] ? video_setup+0x7f/0x7f [0.372000] ? acpi_sleep_proc_init+0x27/0x27 [0.372000] ? do_one_initcall+0x4e/0x1a0 [0.372000] ? kernel_init_freeable+0x189/0x20a [0.372000] ? rest_init+0xc0/0xc0 [ 0.372000] ? kernel_init+0xa/0x100 [ 0.372000] ? ret_from_fork+0x25/0x30 [ 0.388039] kmem_cache_destroy Acpi-parse_ext: La cach\u00e9 Slab a\u00fan tiene objetos [ 0.389063] CPU: 1 PID: 1 Comm: swapper/0 Contaminado: GW 4.12.0-rc4-next-20170608+ #8 [ 0.390557] Nombre del hardware: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 [ 0.392000] Rastreo de llamadas: [ 0.392000] ? dump_stack+0x5c/0x81 [ 0.392000] ? kmem_cache_destroy+0x1aa/0x1c0 [ 0.392000] ? acpi_sleep_proc_init+0x27/0x27 [ 0.392000] ? acpi_os_delete_cache+0xa/0x10 [ 0.392000] ? acpi_ut_delete_caches+0x6d/0x7b [ 0.392000] ? acpi_terminate+0xa/0x14 [ 0.392000] ? acpi_init+0x2af/0x3 ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/acpi/acpica/psobject.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"88ac00f5a841dcfc5c682000f4a6add0add8caac\",\"lessThan\":\"1e0e629e88b1f7751ce69bf70cda6d1598d45271\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"88ac00f5a841dcfc5c682000f4a6add0add8caac\",\"lessThan\":\"41afebc9a0762aafc35d2df88f4e1b798155a940\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"88ac00f5a841dcfc5c682000f4a6add0add8caac\",\"lessThan\":\"960236150cd3f08e13b397dd5ae4ccf7a2986c00\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"88ac00f5a841dcfc5c682000f4a6add0add8caac\",\"lessThan\":\"0a119fdaed67566aa3e0b5222dced4d08bbce463\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"88ac00f5a841dcfc5c682000f4a6add0add8caac\",\"lessThan\":\"1fee4324b5660de080cefc3fc91c371543bdb8f6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"88ac00f5a841dcfc5c682000f4a6add0add8caac\",\"lessThan\":\"198c2dab022e5e94a99fff267b669d693bc7bb49\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"88ac00f5a841dcfc5c682000f4a6add0add8caac\",\"lessThan\":\"3e0c59180ec83bdec43b3d3482cff23d86d380d0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"88ac00f5a841dcfc5c682000f4a6add0add8caac\",\"lessThan\":\"bed18f0bdcd6737a938264a59d67923688696fc4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/acpi/acpica/psobject.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.295\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.239\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.186\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.142\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.95\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.35\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.4\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.4.295\",\"matchCriteriaId\":\"BA4BF151-0908-4C15-9931-A867361FC272\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.239\",\"matchCriteriaId\":\"C3D14F4C-A21E-465D-A928-5CCE684E2B98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.186\",\"matchCriteriaId\":\"D96F2C0D-0D4A-4658-AD34-D8A626EA422D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.142\",\"matchCriteriaId\":\"459B4E94-FE0E-434D-B782-95E3A5FFC6B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.95\",\"matchCriteriaId\":\"C5E01853-7048-4D78-9479-9AEE41AC8456\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.35\",\"matchCriteriaId\":\"E569FD34-0076-4428-BE17-EECCF867611C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.4\",\"matchCriteriaId\":\"DFD174C5-1AA2-4671-BDDC-1A9FCC753655\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0a119fdaed67566aa3e0b5222dced4d08bbce463\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/198c2dab022e5e94a99fff267b669d693bc7bb49\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1e0e629e88b1f7751ce69bf70cda6d1598d45271\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1fee4324b5660de080cefc3fc91c371543bdb8f6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3e0c59180ec83bdec43b3d3482cff23d86d380d0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/41afebc9a0762aafc35d2df88f4e1b798155a940\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/960236150cd3f08e13b397dd5ae4ccf7a2986c00\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bed18f0bdcd6737a938264a59d67923688696fc4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T01:04:29+00:00",
      "cve": "CVE-2025-38344",
      "id": "CVE-2025-38344",
      "initial_release_date": "2025-07-10T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ACPICA: fix acpi parse and parseext cache leaks",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38344.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:18:42Z",
      "cve": "CVE-2025-38344",
      "id": "CVE-2025-38344",
      "initial_release_date": "2026-05-27T03:02:15Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "727",
      "product_status:known_not_affected": "49",
      "product_status:recommended": "472",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38344",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38344.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.