In the Linux kernel, the following vulnerability has been resolved:[EOL][EOL]ACPI: video: Fix use-after-free in acpi_video_switch_brightness()[EOL][EOL]The switch_brightness_work delayed work accesses device->brightness[EOL]and device->backlight, freed by acpi_video_dev_unregister_backlight()[EOL]during device removal.[EOL][EOL]If the work executes after acpi_video_bus_unregister_backlight()[EOL]frees these resources, it causes a use-after-free when[EOL]acpi_video_switch_brightness() dereferences device->brightness or[EOL]device->backlight.[EOL][EOL]Fix this by calling cancel_delayed_work_sync() for each device's[EOL]switch_brightness_work in acpi_video_bus_remove_notify_handler()[EOL]after removing the notify handler that queues the work. This ensures[EOL]the work completes before the memory is freed.[EOL][EOL][ rjw: Changelog edit ]
