CVE-2025-40211

What it actually does

Use-after-free in ACPI video subsystem where switch_brightness_work delayed work dereferences device->brightness and device->backlight pointers after acpi_video_dev_unregister_backlight has freed them during device removal.

Why it matters to the business

Kernel instability or crashes on Linux systems during ACPI video device removal or hotplug events, potentially disrupting display management on servers, laptops, and embedded devices; low exploitability reduces immediate risk but still requires patching to maintain system reliability.

How an attack unfolds

An attacker with local access triggers ACPI video device removal or unregistration while a brightness switch delayed work remains queued; if the work executes after memory is freed, it dereferences invalid pointers leading to a use-after-free condition that may allow memory corruption or denial of service.

How to fix it

Update the Linux kernel to a version containing commit 3f803ccf5a0c043e7c8b83f6665b082401fc8bee or later; apply the fix that calls cancel_delayed_work_sync on switch_brightness_work before freeing associated backlight resources.

How to confirm the fix worked

Verify the running kernel includes the referenced commit or equivalent backport; test ACPI video device removal and brightness operations under load to confirm no use-after-free occurs; review dmesg and kernel logs for related ACPI video warnings.

Typical attack path

1. Obtain local access to a Linux system using the vulnerable ACPI video driver
2. Trigger conditions that queue switch_brightness_work (e.g., brightness change notifications)
3. Force device removal or unregistration via acpi_video_bus_remove_notify_handler or similar paths
4. Allow the delayed work to execute after resources are freed
5. Exploit resulting use-after-free for memory corruption or crash

How to detect it

Search kernel logs and dmesg for ACPI video errors, use-after-free warnings, or crashes referencing acpi_video_switch_brightness or acpi_video_bus_remove_notify_handler; monitor for unexpected device removal events on systems with ACPI video support.

What your security team should do

• Prioritize kernel updates on all Linux systems exposing ACPI video interfaces within standard patch cycles
• Monitor for new stable kernel releases containing the fix commit
• Review ACPI video usage in affected environments and disable unnecessary video backlight features if feasible
• Incorporate kernel use-after-free mitigations such as KASAN in test environments