CVE-2025-71111

A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability was found in the Linux kernel's w83791d hardware monitoring driver. The FAN_FROM_REG macro evaluates its arguments multiple times, and when used in lockless contexts with shared driver data, a race condition can cause the divisor value to change between check and use, potentially leading to a divide-by-zero error.

This vulnerability affects systems with Winbond W83791D hardware monitoring chips. The race condition requires concurrent access to fan divisor settings, which is uncommon in typical usage scenarios. The divide-by-zero would cause a kernel crash (denial of service). Physical access to the monitoring hardware configuration is effectively required.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the w83791d module from being loaded if Winbond W83791D hardware monitoring is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.