CVE-2025-40211

In the Linux kernel, the following vulnerability has been resolved:

ACPI: video: Fix use-after-free in acpi_video_switch_brightness()

The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal.

If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight.

Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed.

[ rjw: Changelog edit ]

A use after free occurred in acpi_video_switch_brightness() because delayed work (switch_brightness_work) could run after its associated device->brightness or device->backlight fields were freed during ACPI video device removal. This bug is locally triggerable (privileged or kernel-context only) and mainly leads to kernel crashes (DoS). It demonstrates a race condition between workqueue cleanup and device teardown.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.