CVE-2025-38217

What it actually does

TOCTOU race in fts_read() allows concurrent modification of data->fan_source[channel] between a validity check and its use in BIT(), resulting in a shift of 255 that triggers undefined behavior and potential kernel crash or incorrect sensor values returned to userspace.

Why it matters to the business

Unpatched systems risk sudden crashes or corrupted hardware monitoring data during normal operation or monitoring queries, leading to downtime, unreliable alerting, and potential loss of visibility into system health on affected Linux deployments.

How an attack unfolds

An attacker with local access triggers concurrent calls to fts_read() and fts_update_device() on the ftsteutates hwmon device; by racing the window between the invalid-source check and the BIT() usage, the shared fan_source value is changed to trigger an out-of-bounds shift that crashes the kernel or returns garbage readings.

How to fix it

Upgrade the Linux kernel to a commit containing the fix (d95d87841d2a575bed3691884e8fedef57d7710d or later stable backports) or apply the equivalent patch that reads fan_source once into a local variable and adds a bounds check before BIT(). For Chainguard images, update to mattermost-10.7-10.7.3-r1 or newer.

How to confirm the fix worked

Confirm the single-read plus bounds-check patch is present in the ftsteutates driver source; test by exercising concurrent hwmon reads and updates under load to verify absence of crashes or out-of-range values.

Typical attack path

1. Obtain local unprivileged access on a system exposing the ftsteutates hwmon sensor.
2. Open or interact with the hwmon sysfs interface to invoke fts_read() for pwm_auto_channels_temp.
3. Concurrently trigger device updates via fts_update_device() to modify fan_source between check and use.
4. Force the BIT(255) shift to induce undefined behavior and kernel instability or incorrect readings.

How to detect it

Review kernel logs for oops or panic entries referencing BIT shift errors or ftsteutates during hwmon activity; correlate timestamps of sysfs hwmon accesses with fts_update_device calls.

What your security team should do

• Prioritize kernel updates on all systems using ftsteutates hwmon sensors within the next maintenance window.
• Monitor upstream stable kernel releases for additional hwmon fixes and schedule automated patching.
• Limit unprivileged local access where possible until patches are deployed.