🛡️ AZL-64707 — kernel

CVE-2025-38217 affecting package kernel for versions less than 6.6.96.1-1

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (ftsteutates) Fix TOCTOU race in fts_read()

In the fts_read() function, when handling hwmon_pwm_auto_channels_temp,

the code accesses the shared variable data->fan_source[channel] twice

without holding any locks. It is first checked against

FTS_FAN_SOURCE_INVALID, and if the check passes, it is read again

when used as an argument to the BIT() macro.

This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition.

Another thread executing fts_update_device() can modify the value of

data->fan_source[channel] between the check and its use. If the value

is changed to FTS_FAN_SOURCE_INVALID (0xff) during this window, the

BIT() macro will be called with a large shift value (BIT(255)).

A bit shift by a value greater than or equal to the type width is

undefined behavior and can lead to a crash or incorrect values being

returned to userspace.

Fix this by reading data->fan_source[channel] into a local variable

once, eliminating the race condition. Additionally, add a bounds check

to ensure the value is less than BITS_PER_LONG before passing it to

the BIT() macro, making the code more robust against undefined behavior.

This possible bug was found by an experimental static analysis tool

developed by our team.