CVE-2025-38217

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (ftsteutates) Fix TOCTOU race in fts_read()

In the fts_read() function, when handling hwmon_pwm_auto_channels_temp,

the code accesses the shared variable data->fan_source[channel] twice

without holding any locks. It is first checked against

FTS_FAN_SOURCE_INVALID, and if the check passes, it is read again

when used as an argument to the BIT() macro.

This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition.

Another thread executing fts_update_device() can modify the value of

data->fan_source[channel] between the check and its use. If the value

is changed to FTS_FAN_SOURCE_INVALID (0xff) during this window, the

BIT() macro will be called with a large shift value (BIT(255)).

A bit shift by a value greater than or equal to the type width is

undefined behavior and can lead to a crash or incorrect values being

returned to userspace.

Fix this by reading data->fan_source[channel] into a local variable

onc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References