CVE-2025-40211

ACPI: video: Fix use-after-free in acpi_video_switch_brightness()

State: Published
Severity: Not scored
Published: Nov 21, 2025
Updated: Jun 16, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ACPI: video: Fix use-after-free in acpi_video_switch_brightness()

The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal.

If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight.

Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed.

[ rjw: Changelog edit ]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7 to before 3f803ccf5a0c043e7c8b83f6665b082401fc8beeAffected 8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7 to before ba1704316492a0496c69334338ea1fdbf4c2fd34Affected 8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7 to before bc78a4f51d548c1ccc3d1967c2b394bf687c86e9Affected 8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7 to before a63a5b6fb508d78fe57ae3b159d9ef3af7ba80e9Affected 8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7 to before 4e85246ec0d019dfba86ba54d841ef6694f97149Affected 8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7 to before de5fc93275a4a459fe2f7cb746984f2ab3e8292aAffected 8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7 to before 293125536ef5521328815fa7c76d5f9eb1635659Affected 8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7 to before 8f067aa59430266386b83c18b983ca583faa6a11Affected
LinuxLinux	3.17Affected before 3.17Not affected 5.4.302 through 5.4.Not affected 5.10.247 through 5.10.Not affected 5.15.197 through 5.15.Not affected 6.1.159 through 6.1.Not affected 6.6.117 through 6.6.Not affected 6.12.58 through 6.12.Not affected 6.17.8 through 6.17.*Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7 to before 3f803ccf5a0c043e7c8b83f6665b082401fc8beeAffected
8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7 to before ba1704316492a0496c69334338ea1fdbf4c2fd34Affected
8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7 to before bc78a4f51d548c1ccc3d1967c2b394bf687c86e9Affected
8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7 to before a63a5b6fb508d78fe57ae3b159d9ef3af7ba80e9Affected
8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7 to before 4e85246ec0d019dfba86ba54d841ef6694f97149Affected
8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7 to before de5fc93275a4a459fe2f7cb746984f2ab3e8292aAffected
8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7 to before 293125536ef5521328815fa7c76d5f9eb1635659Affected
8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7 to before 8f067aa59430266386b83c18b983ca583faa6a11Affected

LinuxLinux

3.17Affected
before 3.17Not affected
5.4.302 through 5.4.*Not affected
5.10.247 through 5.10.*Not affected
5.15.197 through 5.15.*Not affected
6.1.159 through 6.1.*Not affected
6.6.117 through 6.6.*Not affected
6.12.58 through 6.12.*Not affected
6.17.8 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.