CVE-2025-71111: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71111 is a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in the Linux kernel's w83791d hardware monitoring (hwmon) driver. The flaw exists in the FAN_FROM_REG macro, which evaluates its arguments multiple times in lockless contexts involving shared driver data, potentially causing divide-by-zero kernel errors. It was published on January 14, 2026, and affects a wide range of Linux kernel versions from 2.6.18 through pre-patched stable releases across multiple branches. The vulnerability carries a CVSS v3.1 base score of 4.7 (Medium) (Feedly, kernel.org patches).

The root cause is classified as CWE-367 (Time-of-check Time-of-use Race Condition). The FAN_FROM_REG macro in the w83791d hwmon driver evaluates its arguments multiple times; when invoked in lockless contexts where shared driver data can be concurrently modified, a race window opens between the check and use of a divisor value, potentially resulting in a divide-by-zero kernel panic. Additionally, the store_fan_div function performed a read-modify-write sequence outside the update lock, allowing inconsistent data to be used in calculations. The fix converts the macro to a static inline function (ensuring single argument evaluation) and moves the minimum limit calculation inside the update lock (Feedly). Exploitation requires local access, low privileges, and precise timing, making attack complexity high.

Successful exploitation results in a kernel divide-by-zero error, causing a kernel panic and system crash — a denial-of-service condition. There is no impact on confidentiality or integrity; only availability is affected. The vulnerability is limited to systems equipped with Winbond W83791D hardware monitoring chips, which are typically found in older server and embedded hardware platforms (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.018% (0.000180), reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. High attack complexity — requiring precise timing and specific hardware — significantly limits practical exploitability.

• Logs: Unexpected kernel panic messages in /var/log/kern.log or dmesg output referencing divide-by-zero errors in the w83791d hwmon driver module.
• Process/System: Sudden system reboots or kernel oops traces involving w83791d or hwmon subsystem stack frames.
• Hardware: Presence of Winbond W83791D hardware monitoring chip (identifiable via sensors-detect or lspci/lsmod showing w83791d module loaded).

Apply the appropriate patched Linux kernel version for your branch: before 5.10.248, before 5.15.198, before 6.1.160, before 6.6.120, before 6.12.64, or before 6.18.3. Patches are available via the stable kernel tree on git.kernel.org across multiple branches (kernel.org patches). Debian LTS users should apply the update referenced in DLA-4475-1, and Amazon Linux 2 users should apply ALAS2KERNEL-5.10-2026-113. As a temporary workaround where patching is not immediately possible, unloading the w83791d kernel module (rmmod w83791d) on systems where hardware monitoring is not critical will eliminate the attack surface.