CVE-2025-40211

In the Linux kernel, the following vulnerability has been resolved:

ACPI: video: Fix use-after-free in acpivideoswitch_brightness()

The switchbrightnesswork delayed work accesses device->brightness and device->backlight, freed by acpivideodevunregisterbacklight() during device removal.

If the work executes after acpivideobusunregisterbacklight() frees these resources, it causes a use-after-free when acpivideoswitch_brightness() dereferences device->brightness or device->backlight.

Fix this by calling canceldelayedworksync() for each device's switchbrightnesswork in acpivideobusremovenotifyhandler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed.

[ rjw: Changelog edit ]