Use After Free The advisory has been revoked - it doesn't affect any version of package kernel-headers (opens in a new tab)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RHEL10-KERNELHEADERS-14096853
- published22 Nov 2025
- disclosed21 Nov 2025
Introduced: 21 Nov 2025
CVE-2025-40211 (opens in a new tab)Amendment
The Red Hat security team deemed this advisory irrelevant for RHEL:10.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-headers package and not the kernel-headers package as distributed by RHEL.
In the Linux kernel, the following vulnerability has been resolved:
ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal.
If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight.
Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed.
[ rjw: Changelog edit ]
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2416309
- https://access.redhat.com/security/cve/CVE-2025-40211
- https://git.kernel.org/stable/c/293125536ef5521328815fa7c76d5f9eb1635659
- https://git.kernel.org/stable/c/8f067aa59430266386b83c18b983ca583faa6a11
- https://git.kernel.org/stable/c/de5fc93275a4a459fe2f7cb746984f2ab3e8292a
- https://git.kernel.org/stable/c/4e85246ec0d019dfba86ba54d841ef6694f97149
- https://git.kernel.org/stable/c/3f803ccf5a0c043e7c8b83f6665b082401fc8bee
- https://git.kernel.org/stable/c/a63a5b6fb508d78fe57ae3b159d9ef3af7ba80e9
- https://git.kernel.org/stable/c/ba1704316492a0496c69334338ea1fdbf4c2fd34
- https://git.kernel.org/stable/c/bc78a4f51d548c1ccc3d1967c2b394bf687c86e9