In the Linux kernel, the following vulnerability has been resolved: ACPI: video: Fix use-after-free in acpivideoswitchbrightness() The switchbrightnesswork delayed work accesses device->brightness and device->backlight, freed by acpivideodevunregisterbacklight() during device removal. If the work executes after acpivideobusunregisterbacklight() frees these resources, it causes a use-after-free when acpivideoswitchbrightness() dereferences device->brightness or device->backlight. Fix this by calling canceldelayedworksync() for each device's switchbrightnesswork in acpivideobusremovenotifyhandler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed. [ rjw: Changelog edit ]