CVE-2025-40211

Vulnerability

CVE-2025-40211 is a use-after-free vulnerability in the Linux kernel's ACPI video driver. The function acpi_video_switch_brightness() accesses device->brightness and device->backlight structures that are freed by acpi_video_dev_unregister_backlight() during device removal. If the delayed work switch_brightness_work executes after acpi_video_bus_unregister_backlight() has freed these resources, the driver dereferences freed memory, leading to a use-after-free condition [1].

Exploitation

The vulnerability is triggered when a user or system event causes the brightness switch work to be queued, and then the device is removed before the work executes. No special privileges are required beyond the ability to trigger device removal (e.g., hot-unplug of a display or docking station). The attack surface is local, as the ACPI video driver is part of the kernel and accessible to any user who can cause device removal events.

Impact

An attacker who can trigger the race condition may cause a use-after-free, potentially leading to memory corruption, system crash (denial of service), or possibly arbitrary code execution in kernel context. The exact impact depends on the kernel memory allocator state and the attacker's ability to control freed memory.

Mitigation

The fix, committed in the Linux kernel stable tree, ensures that cancel_delayed_work_sync() is called for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This guarantees the work completes before the memory is freed [1]. Users should apply the latest stable kernel updates containing this patch.