CVE-2025-40211: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40211 is a use-after-free vulnerability in the Linux kernel's ACPI video subsystem, specifically in the acpi_video_switch_brightness() function. The flaw arises when the switch_brightness_work delayed work item accesses device->brightness and device->backlight resources after they have been freed by acpi_video_dev_unregister_backlight() during device removal. It affects Linux kernel versions from 3.17 up to the patched releases (6.12.58, 6.17.8, and 6.18-rc4), and also impacts Microsoft Azure Linux 3 kernel builds prior to version 6.6.112.1-2. The vulnerability was published on November 21, 2025, and carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, Microsoft MSRC).

The root cause is a race condition leading to a use-after-free (CWE-416) in the Linux kernel's ACPI video driver. When a device is removed, acpi_video_bus_unregister_backlight() frees device->brightness and device->backlight, but the switch_brightness_work delayed work item — queued by the ACPI notify handler — may execute after this deallocation, causing acpi_video_switch_brightness() to dereference freed memory. The attack vector is local (requiring low-privilege access), with low attack complexity and no user interaction required. The fix involves calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler, ensuring the work completes before memory is freed (Red Hat CVE, Kernel Patch 1).

Successful exploitation of this use-after-free vulnerability can result in kernel crashes, memory corruption, and potentially arbitrary code execution in kernel context. The confidentiality, integrity, and availability impacts are all rated High, meaning an attacker could potentially escalate privileges, corrupt kernel memory, or cause a denial of service (system crash). The vulnerability is scoped to the local system and does not directly enable lateral movement, but privilege escalation to root could facilitate further compromise (Red Hat CVE).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, limiting the attack surface compared to remotely exploitable vulnerabilities (Red Hat CVE).

Update the Linux kernel to a patched version: 6.12.58, 6.17.8, or 6.18-rc4 and later. Microsoft Azure Linux 3 users should update to kernel version 6.6.112.1-2 or later. Debian LTS users should apply the updates referenced in DLA-4404-1 and DLA-4436-1. Ubuntu users should apply the fixes from USN-8096-1, USN-8096-2, USN-8096-3, and USN-8096-5. Amazon Linux 2 users should apply ALAS2KERNEL-5.15-2025-096 or ALAS2KERNEL-5.10-2026-112 as applicable. No configuration-based workaround is available; patching is the only remediation (Red Hat CVE, Microsoft MSRC, Debian LTS, Ubuntu USN).