Bug 2429573 (CVE-2025-71111)

Summary: CVE-2025-71111 kernel: hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability was found in the Linux kernel's w83791d hardware monitoring driver. The FAN_FROM_REG macro evaluates its arguments multiple times, and when used in lockless contexts with shared driver data, a race condition can cause the divisor value to change between check and use, potentially leading to a divide-by-zero error.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-01-14 16:01:16 UTC 
In the Linux kernel, the following vulnerability has been resolved:

hwmon: (w83791d) Convert macros to functions to avoid TOCTOU

The macro FAN_FROM_REG evaluates its arguments multiple times. When used
in lockless contexts involving shared driver data, this leads to
Time-of-Check to Time-of-Use (TOCTOU) race conditions, potentially
causing divide-by-zero errors.

Convert the macro to a static function. This guarantees that arguments
are evaluated only once (pass-by-value), preventing the race
conditions.

Additionally, in store_fan_div, move the calculation of the minimum
limit inside the update lock. This ensures that the read-modify-write
sequence operates on consistent data.

Adhere to the principle of minimal changes by only converting macros
that evaluate arguments multiple times and are used in lockless
contexts.
Comment 1 Jon Moroney 2026-01-14 21:18:09 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026011412-CVE-2025-71111-1547@gregkh/T