TOCTOU Race Condition in Linux Kernel's hwmon: linux Package Vulnerability
Summary
DEBIAN-CVE-2025-38217: In the Linux kernel, the following vulnerability has been resolved: hwmon: (ftsteutates) Fix TOCTOU race in fts_read() In the fts_read() function, when handling hwmon_pwm_auto_channels_temp, the code accesses the shared... Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the Linux kernel that manages system resources and hardware interactions. It is essential for the functioning of the operating system, enabling communication between software and hardware. This vulnerability affects the hwmon subsystem, which is responsible for monitoring hardware parameters such as temperature and fan speeds. The issue arises from improper handling of shared variables, leading to potential system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the hwmon subsystem, specifically in the fts_read() function. This vulnerability is a Time-of-Check to Time-of-Use (TOCTOU) race condition, where the code accesses the shared variable data->fan_source[channel] twice without proper locking mechanisms. This can allow another thread to modify the value between the check and its use, potentially leading to undefined behavior, crashes, or incorrect values being returned to userspace. The vulnerability was discovered through an experimental static analysis tool.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package as described above.
Conclusion
The vulnerability identified in the Linux kernel's hwmon subsystem poses a significant risk due to the potential for system instability and crashes. Users are strongly encouraged to update their linux package to the patched version 6.12.35-1 or later to mitigate this risk. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
A TOCTOU race condition occurs when a program checks a condition and then uses the result of that check without ensuring that the condition has not changed in the meantime, potentially leading to unexpected behavior.
Exploiting this vulnerability could lead to system crashes or incorrect data being processed, which may affect the stability and reliability of applications relying on the hwmon subsystem.
If you are using the linux package version prior to 6.12.35-1, your system may be vulnerable. You can check your package version using the command 'apt list --installed | grep linux'.
Regularly update your system and installed packages to the latest versions. Use tools like Vulert to monitor for vulnerabilities in your open-source software.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
