CVE-2025-71197

w1: therm: Fix off-by-one buffer overflow in alarms_store

State
Published
Severity
Not scored
Published
Feb 4, 2026
Updated
Oct 15, 2026
Reserved
Jan 31, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

w1: therm: Fix off-by-one buffer overflow in alarms_store

The sysfs buffer passed to alarms_store() is allocated with 'size + 1' bytes and a NUL terminator is appended. However, the 'size' argument does not account for this extra byte. The original code then allocated 'size' bytes and used strcpy() to copy 'buf', which always writes one byte past the allocated buffer since strcpy() copies until the NUL terminator at index 'size'.

Fix this by parsing the 'buf' parameter directly using simple_strtoll() without allocating any intermediate memory or string copying. This removes the overflow while simplifying the code.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • e2c94d6f572079511945e64537eb1218643f2e68 to before 49ff9b4b9deacbefa6654a0a2bcaf910c9de7e95Affected
  • e2c94d6f572079511945e64537eb1218643f2e68 to before 060b08d72a38b158a7f850d4b83c17c2969e0f6bAffected
  • e2c94d6f572079511945e64537eb1218643f2e68 to before b3fc3e1f04dcc7c41787bbf08a6e0d2728e022cfAffected
  • e2c94d6f572079511945e64537eb1218643f2e68 to before 6a5820ecfa5a76c3d3e154802c8c15f391ef442eAffected
  • e2c94d6f572079511945e64537eb1218643f2e68 to before 6fd6d2a8e41b7f544a4d26cbd60bedf9c67893a0Affected
  • e2c94d6f572079511945e64537eb1218643f2e68 to before e6b2609af21b5cccc9559339591b8a2cbf884169Affected
  • e2c94d6f572079511945e64537eb1218643f2e68 to before 761fcf46a1bd797bd32d23f3ea0141ffd437668aAffected
LinuxLinux
  • 5.8Affected
  • before 5.8Not affected
  • 5.10.249 through 5.10.*Not affected
  • 5.15.199 through 5.15.*Not affected
  • 6.1.162 through 6.1.*Not affected
  • 6.6.122 through 6.6.*Not affected
  • 6.12.68 through 6.12.*Not affected
  • 6.18.8 through 6.18.*Not affected
  • 6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.