{"id":"CVE-2025-71111","title":"hwmon: (w83791d) Convert macros to functions to avoid TOCTOU","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (w83791d) Convert macros to functions to avoid TOCTOU\n\nThe macro FAN_FROM_REG evaluates its arguments multiple times. When used\nin lockless contexts involving sh…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 9873964d6eb24bd0205394f9b791de9eddbcb855 < 3dceb68f6ad33156032ef4da21a93d84059cca6d","Linux >= 9873964d6eb24bd0205394f9b791de9eddbcb855 < bf5b03227f2e6d4360004886d268f9df8993ef8f","Linux >= 9873964d6eb24bd0205394f9b791de9eddbcb855 < f2b579a0c37c0df19603d719894a942a295f634a","Linux >= 9873964d6eb24bd0205394f9b791de9eddbcb855 < f94800fbc26ccf7c81eb791707b038a57aa39a18","Linux >= 9873964d6eb24bd0205394f9b791de9eddbcb855 < a9fb6e8835a22f5796c1182ed612daed3fd273af","Linux >= 9873964d6eb24bd0205394f9b791de9eddbcb855 < c8cf0c2bdcccc6634b6915ff793b844e12436680","Linux >= 9873964d6eb24bd0205394f9b791de9eddbcb855 < 670d7ef945d3a84683594429aea6ab2cdfa5ceb4","Linux 2.6.18"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-10T20:42:13.069072Z"},"published":"2026-01-14","updated":"2026-10-19","sourceUpdated":"2026-10-19T18:15:13.644Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71111","references":[{"url":"https://git.kernel.org/stable/c/3dceb68f6ad33156032ef4da21a93d84059cca6d"},{"url":"https://git.kernel.org/stable/c/bf5b03227f2e6d4360004886d268f9df8993ef8f"},{"url":"https://git.kernel.org/stable/c/f2b579a0c37c0df19603d719894a942a295f634a"},{"url":"https://git.kernel.org/stable/c/f94800fbc26ccf7c81eb791707b038a57aa39a18"},{"url":"https://git.kernel.org/stable/c/a9fb6e8835a22f5796c1182ed612daed3fd273af"},{"url":"https://git.kernel.org/stable/c/c8cf0c2bdcccc6634b6915ff793b844e12436680"},{"url":"https://git.kernel.org/stable/c/670d7ef945d3a84683594429aea6ab2cdfa5ceb4"}],"tags":["cve.org"],"epss":0.00105,"epssPercentile":0.01001,"ingestedAt":"2026-10-19T18:35:50.134Z","slug":"CVE-2025-71111","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (w83791d) Convert macros to functions to avoid TOCTOU\n\nThe macro FAN_FROM_REG evaluates its arguments multiple times. When used\nin lockless contexts involving shared driver data, this leads to\nTime-of-Check to Time-of-Use (TOCTOU) race conditions, potentially\ncausing divide-by-zero errors.\n\nConvert the macro to a static function. This guarantees that arguments\nare evaluated only once (pass-by-value), preventing the race\nconditions.\n\nAdditionally, in store_fan_div, move the calculation of the minimum\nlimit inside the update lock. This ensures that the read-modify-write\nsequence operates on consistent data.\n\nAdhere to the principle of minimal changes by only converting macros\nthat evaluate arguments multiple times and are used in lockless\ncontexts.\n\n## Affected\n\n- `Linux >= 9873964d6eb24bd0205394f9b791de9eddbcb855 < 3dceb68f6ad33156032ef4da21a93d84059cca6d`\n- `Linux >= 9873964d6eb24bd0205394f9b791de9eddbcb855 < bf5b03227f2e6d4360004886d268f9df8993ef8f`\n- `Linux >= 9873964d6eb24bd0205394f9b791de9eddbcb855 < f2b579a0c37c0df19603d719894a942a295f634a`\n- `Linux >= 9873964d6eb24bd0205394f9b791de9eddbcb855 < f94800fbc26ccf7c81eb791707b038a57aa39a18`\n- `Linux >= 9873964d6eb24bd0205394f9b791de9eddbcb855 < a9fb6e8835a22f5796c1182ed612daed3fd273af`\n- `Linux >= 9873964d6eb24bd0205394f9b791de9eddbcb855 < c8cf0c2bdcccc6634b6915ff793b844e12436680`\n- `Linux >= 9873964d6eb24bd0205394f9b791de9eddbcb855 < 670d7ef945d3a84683594429aea6ab2cdfa5ceb4`\n- `Linux 2.6.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}