Use-After-Free Vulnerability in Linux Kernel ACPI Video Component

CVE-2025-40211

What is CVE-2025-40211?

A vulnerability in the ACPI video component of the Linux kernel has been identified, which can lead to a use-after-free condition. This issue arises when the switch_brightness_work deferred work accesses members device->brightness and device->backlight that have already been freed during the device removal process. The improper management of delayed work can cause dereferencing to invalid memory, resulting in potential crashes or other unintended behaviors. The vulnerability has been addressed by ensuring that all queued work is canceled before freeing the associated resources, thus preventing the dereferencing of freed pointers.

References