VYPR
← All advisories
Unrated severityNVD Advisory· Published Nov 21, 2025· Updated Apr 15, 2026

CVE-2025-40211

CVE-2025-40211

Description

In the Linux kernel, the following vulnerability has been resolved:

ACPI: video: Fix use-after-free in acpi_video_switch_brightness()

The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal.

If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight.

Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed.

[ rjw: Changelog edit ]

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

103

Patches

Vulnerability mechanics

References

8

News mentions

0

No linked articles in our index yet.