« Volver al listado

CVE-2025-40211

Estado: AplazadaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

ACPI: video: Fix use-after-free in acpi_video_switch_brightness()

The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal.

If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight.

Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed.

Leer descripción completaMostrar menos

[ rjw: Changelog edit ]

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-40211",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-40211",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-16T19:58:30.759747Z"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7",
              "lessThan": "3f803ccf5a0c043e7c8b83f6665b082401fc8bee",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7",
              "lessThan": "ba1704316492a0496c69334338ea1fdbf4c2fd34",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7",
              "lessThan": "bc78a4f51d548c1ccc3d1967c2b394bf687c86e9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7",
              "lessThan": "a63a5b6fb508d78fe57ae3b159d9ef3af7ba80e9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7",
              "lessThan": "4e85246ec0d019dfba86ba54d841ef6694f97149",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7",
              "lessThan": "de5fc93275a4a459fe2f7cb746984f2ab3e8292a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7",
              "lessThan": "293125536ef5521328815fa7c76d5f9eb1635659",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8ab58e8e7e097bae5fe39cbc67eb93a91f7134b7",
              "lessThan": "8f067aa59430266386b83c18b983ca583faa6a11",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/acpi/acpi_video.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.4.302",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.247",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.197",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver",
              "lessThanOrEqual": "6.17.*"
            },
            {
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/acpi/acpi_video.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-11-21T11:15:49.513",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/293125536ef5521328815fa7c76d5f9eb1635659",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3f803ccf5a0c043e7c8b83f6665b082401fc8bee",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4e85246ec0d019dfba86ba54d841ef6694f97149",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8f067aa59430266386b83c18b983ca583faa6a11",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a63a5b6fb508d78fe57ae3b159d9ef3af7ba80e9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ba1704316492a0496c69334338ea1fdbf4c2fd34",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bc78a4f51d548c1ccc3d1967c2b394bf687c86e9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/de5fc93275a4a459fe2f7cb746984f2ab3e8292a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: video: Fix use-after-free in acpi_video_switch_brightness()\n\nThe switch_brightness_work delayed work accesses device->brightness\nand device->backlight, freed by acpi_video_dev_unregister_backlight()\nduring device removal.\n\nIf the work executes after acpi_video_bus_unregister_backlight()\nfrees these resources, it causes a use-after-free when\nacpi_video_switch_brightness() dereferences device->brightness or\ndevice->backlight.\n\nFix this by calling cancel_delayed_work_sync() for each device's\nswitch_brightness_work in acpi_video_bus_remove_notify_handler()\nafter removing the notify handler that queues the work. This ensures\nthe work completes before the memory is freed.\n\n[ rjw: Changelog edit ]"
    }
  ],
  "lastModified": "2026-06-17T09:21:27.897",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}