CVE-2025-71111

Description

In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83791d) Convert macros to functions to avoid TOCTOU The macro FAN_FROM_REG evaluates its arguments multiple times. When used in lockless contexts involving shared driver data, this leads to Time-of-Check to Time-of-Use (TOCTOU) race conditions, potentially causing divide-by-zero errors. Convert the macro to a static function. This guarantees that arguments are evaluated only once (pass-by-value), preventing the race conditions. Additionally, in store_fan_div, move the calculation of the minimum limit inside the update lock. This ensures that the read-modify-write sequence operates on consistent data. Adhere to the principle of minimal changes by only converting macros that evaluate arguments multiple times and are used in lockless contexts.

CVSS Details

CVSS Score

4.7

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux kernel w83791d driver < 3dceb68f6ad33156032ef4da21a93d84059cca6d

Linux kernel w83791d driver < 670d7ef945d3a84683594429aea6ab2cdfa5ceb4

Linux kernel w83791d driver < a9fb6e8835a22f5796c1182ed612daed3fd273af

Linux kernel w83791d driver < bf5b03227f2e6d4360004886d268f9df8993ef8f

Linux kernel w83791d driver < c8cf0c2bdcccc6634b6915ff793b844e12436680

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// PoC concept for CVE-2025-71111 TOCTOU race condition
// This demonstrates the race condition in w83791d FAN_FROM_REG macro

#include <stdio.h>
#include <pthread.h>
#include <stdatomic.h>

// Original problematic macro (evaluates val multiple times)
#define FAN_FROM_REG(val) ((val) && (val) != 255) ? (1350000U / (val)) : 0

// Simulated shared driver data
static volatile unsigned long shared_fan_value = 100;
static _Atomic int race_triggered = 0;

void* writer_thread(void* arg) {
    // Simulates another thread modifying the shared value
    for (int i = 0; i < 1000; i++) {
        // Race: modify value to 0 between check and use
        shared_fan_value = 0;  // This can cause divide-by-zero
        shared_fan_value = 100;
    }
    return NULL;
}

void* reader_thread(void* arg) {
    // Simulates using the problematic macro
    for (int i = 0; i < 1000; i++) {
        unsigned long val = shared_fan_value;
        
        // Original macro evaluates 'val' multiple times:
        // First check: (val) && (val) != 255
        // Second use: (1350000U / (val))
        // If val changes between checks, race condition occurs
        unsigned int result = FAN_FROM_REG(val);
        
        // Check if we hit the race condition
        if (shared_fan_value == 0 && val != 0) {
            race_triggered = 1;
            printf("Race condition detected!\n");
        }
    }
    return NULL;
}

int main() {
    pthread_t t1, t2;
    
    pthread_create(&t1, NULL, writer_thread, NULL);
    pthread_create(&t2, NULL, reader_thread, NULL);
    
    pthread_join(t1, NULL);
    pthread_join(t2, NULL);
    
    printf("PoC execution completed.\n");
    printf("Fix: Convert macro to static function with pass-by-value semantics.\n");
    
    return 0;
}

// Fixed version:
// static inline unsigned int fan_from_reg(unsigned long val)
// {
//     return (val && val != 255) ? (1350000U / val) : 0;
// }

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-71111
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-71111
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-71111/
[4] VulDB https://vuldb.com/cve/CVE-2025-71111
[5] https://git.kernel.org/stable/c/3dceb68f6ad33156032ef4da21a93d84059cca6d
[6] https://git.kernel.org/stable/c/670d7ef945d3a84683594429aea6ab2cdfa5ceb4
[7] https://git.kernel.org/stable/c/a9fb6e8835a22f5796c1182ed612daed3fd273af
[8] https://git.kernel.org/stable/c/bf5b03227f2e6d4360004886d268f9df8993ef8f
[9] https://git.kernel.org/stable/c/c8cf0c2bdcccc6634b6915ff793b844e12436680
[10] https://git.kernel.org/stable/c/f2b579a0c37c0df19603d719894a942a295f634a
[11] https://git.kernel.org/stable/c/f94800fbc26ccf7c81eb791707b038a57aa39a18

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-71111", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-01-14T15:16:00.193", "lastModified": "2026-03-25T19:27:20.137", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (w83791d) Convert macros to functions to avoid TOCTOU\n\nThe macro FAN_FROM_REG evaluates its arguments multiple times. When used\nin lockless contexts involving shared driver data, this leads to\nTime-of-Check to Time-of-Use (TOCTOU) race conditions, potentially\ncausing divide-by-zero errors.\n\nConvert the macro to a static function. This guarantees that arguments\nare evaluated only once (pass-by-value), preventing the race\nconditions.\n\nAdditionally, in store_fan_div, move the calculation of the minimum\nlimit inside the update lock. This ensures that the read-modify-write\nsequence operates on consistent data.\n\nAdhere to the principle of minimal changes by only converting macros\nthat evaluate arguments multiple times and are used in lockless\ncontexts."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nhwmon: (w83791d) Convertir macros a funciones para evitar TOCTOU\n\nLa macro FAN_FROM_REG evalúa sus argumentos múltiples veces. Cuando se usa en contextos sin bloqueo que involucran datos de controlador compartidos, esto lleva a condiciones de carrera de Tiempo de Verificación a Tiempo de Uso (TOCTOU), potencialmente causando errores de división por cero.\n\nConvertir la macro a una función estática. Esto garantiza que los argumentos se evalúen solo una vez (paso por valor), previniendo las condiciones de carrera.\n\nAdemás, en store_fan_div, mover el cálculo del límite mínimo dentro del bloqueo de actualización. Esto asegura que la secuencia de lectura-modificación-escritura opere con datos consistentes.\n\nAdherirse al principio de cambios mínimos al convertir solo macros que evalúan argumentos múltiples veces y se usan en contextos sin bloqueo."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 4.7, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.0, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-367"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.18.1", "versionEndExcluding": "5.10.248", "matchCriteriaId": "642330A5-373F-47C0-A575-D6749C3E9A7B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.198", "matchCriteriaId": "82159CAA-B6BA-43C6-85D8-65BDBC175A7E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.160", "matchCriteriaId": "C10CC03E-16A9-428A-B449-40D3763E15F6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.120", "matchCriteriaId": "43C3A206-5EEE-417B-AA0F-EF8972E7A9F0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.64", "matchCriteriaId": "32BF4A52-377C-44ED-B5E6-7EA5D896E98B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.3", "matchCriteriaId": "2DC484D8-FB4F-4112-900F-AE333B6FE7A7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.18:-:*:*:*:*:*:*", "matchCriteriaId": "27C7E25A-EC60-460D-8662-016437F7C0FB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1 ... (truncated)