In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Fix error code path in acpidscallcontrolmethod()
A use-after-free in acpipsparseaml() after a failing invocaion of acpidscallcontrolmethod() is reported by KASAN [1] and code inspection reveals that nextwalkstate pushed to the thread by acpidscreatewalkstate() is freed on errors, but it is not popped from the thread beforehand. Thus acpidsgetcurrentwalkstate() called by acpipsparse_aml() subsequently returns it as the new walk state which is incorrect.
To address this, make acpidscallcontrolmethod() call acpidspopwalkstate() to pop nextwalkstate from the thread before returning an error.