CVE-2025-71111CWE-362CWE-367

CVE-2025-71111

Medium · published January 14, 2026

CVSS v3.1
4.7
EPSS
0%
Percentile
1.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (w83791d) Convert macros to functions to avoid TOCTOU

The macro FAN_FROM_REG evaluates its arguments multiple times. When used

in lockless contexts involving shared driver data, this leads to

Time-of-Check to Time-of-Use (TOCTOU) race conditions, potentially

causing divide-by-zero errors.

Convert the macro to a static function. This guarantees that arguments

are evaluated only once (pass-by-value), preventing the race

conditions.

Additionally, in store_fan_div, move the calculation of the minimum

limit inside the update lock. This ensures that the read-modify-write

sequence operates on consistent data.

Adhere to the principle of minimal changes by only converting macros

that evaluate arguments multiple times and are used in lockless

contexts.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00105 · 1.0th percentile
Weaknesses
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'); CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2026-01-14T20:16Z
Affected products (15)
ProductVersionsFixed in
linux/linux_kernel≥ 2.6.18.1, < 5.10.2485.10.248
linux/linux_kernel≥ 5.11, < 5.15.1985.15.198
linux/linux_kernel≥ 5.16, < 6.1.1606.1.160
linux/linux_kernel≥ 6.2, < 6.6.1206.6.120
linux/linux_kernel≥ 6.7, < 6.12.646.12.64
linux/linux_kernel≥ 6.13, < 6.18.36.18.3
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (7)
EPSS history
Timeline
  • 14 JAN 15:05Z
    hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
    cvelistv5