CVE-2025-38217
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-38217
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38217.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-38217
- Downstream
- Related
- Published
- 2025-07-04T13:37:34Z
- Modified
- 2025-10-18T03:53:00.294026Z
- Summary
- hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
In the ftsread() function, when handling hwmonpwmautochannelstemp, the code accesses the shared variable data->fansource[channel] twice without holding any locks. It is first checked against FTSFANSOURCE_INVALID, and if the check passes, it is read again when used as an argument to the BIT() macro.
This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition. Another thread executing ftsupdatedevice() can modify the value of data->fansource[channel] between the check and its use. If the value is changed to FTSFANSOURCEINVALID (0xff) during this window, the BIT() macro will be called with a large shift value (BIT(255)). A bit shift by a value greater than or equal to the type width is undefined behavior and can lead to a crash or incorrect values being returned to userspace.
Fix this by reading data->fansource[channel] into a local variable once, eliminating the race condition. Additionally, add a bounds check to ensure the value is less than BITSPER_LONG before passing it to the BIT() macro, making the code more robust against undefined behavior.
This possible bug was found by an experimental static analysis tool developed by our team.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/14c9ede9ca4cd078ad76a6ab9617b81074eb58bf
- https://git.kernel.org/stable/c/4d646f627d3b7ed1cacca66e598af8bcd632d465
- https://git.kernel.org/stable/c/83e2ba8971ccd8fc08319fc7593288f070d80a76
- https://git.kernel.org/stable/c/d95d87841d2a575bed3691884e8fedef57d7710d
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1c5759d8ce054961b454af69568a41e7e3210ee1Fixedd95d87841d2a575bed3691884e8fedef57d7710d
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1c5759d8ce054961b454af69568a41e7e3210ee1Fixed83e2ba8971ccd8fc08319fc7593288f070d80a76
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1c5759d8ce054961b454af69568a41e7e3210ee1Fixed4d646f627d3b7ed1cacca66e598af8bcd632d465
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1c5759d8ce054961b454af69568a41e7e3210ee1Fixed14c9ede9ca4cd078ad76a6ab9617b81074eb58bf