{"id":"CVE-2025-71197","revision":"c6b3fd7c98a94f85b225cb740622da8a","records":[{"revision":"c6b3fd7c98a94f85b225cb740622da8a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-71197","aliases":[],"title":"w1: therm: Fix off-by-one buffer overflow in alarms_store","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nw1: therm: Fix off-by-one buffer overflow in alarms_store\n\nThe sysfs buffer passed to alarms_store() is allocated with 'size + 1'\nbytes and a NUL terminator is appended. However, the 'size' argument\ndoes not account for this extra byte. The original code then allocated\n'size' bytes and used strcpy() to copy 'buf', which always writes one\nbyte past the allocated buffer since strcpy() copies until the NUL\nterminator at index 'size'.\n\nFix this by parsing the 'buf' parameter directly using simple_strtoll()\nwithout allocating any intermediate memory or string copying. This\nremoves the overflow while simplifying the code.","state":0,"publishedAt":"2026-02-04T16:07:32.198+00:00","modifiedAt":"2026-10-15T01:11:13.156+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/w1/slaves/w1_therm.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"e2c94d6f572079511945e64537eb1218643f2e68\",\n                            \"lessThan\": \"49ff9b4b9deacbefa6654a0a2bcaf910c9de7e95\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2c94d6f572079511945e64537eb1218643f2e68\",\n                            \"lessThan\": \"060b08d72a38b158a7f850d4b83c17c2969e0f6b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2c94d6f572079511945e64537eb1218643f2e68\",\n                            \"lessThan\": \"b3fc3e1f04dcc7c41787bbf08a6e0d2728e022cf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2c94d6f572079511945e64537eb1218643f2e68\",\n                            \"lessThan\": \"6a5820ecfa5a76c3d3e154802c8c15f391ef442e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2c94d6f572079511945e64537eb1218643f2e68\",\n                            \"lessThan\": \"6fd6d2a8e41b7f544a4d26cbd60bedf9c67893a0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2c94d6f572079511945e64537eb1218643f2e68\",\n                            \"lessThan\": \"e6b2609af21b5cccc9559339591b8a2cbf884169\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2c94d6f572079511945e64537eb1218643f2e68\",\n                            \"lessThan\": \"761fcf46a1bd797bd32d23f3ea0141ffd437668a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/w1/slaves/w1_therm.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.249\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.199\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.162\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.122\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.68\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.8\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/49ff9b4b9deacbefa6654a0a2bcaf910c9de7e95","https://git.kernel.org/stable/c/060b08d72a38b158a7f850d4b83c17c2969e0f6b","https://git.kernel.org/stable/c/b3fc3e1f04dcc7c41787bbf08a6e0d2728e022cf","https://git.kernel.org/stable/c/6a5820ecfa5a76c3d3e154802c8c15f391ef442e","https://git.kernel.org/stable/c/6fd6d2a8e41b7f544a4d26cbd60bedf9c67893a0","https://git.kernel.org/stable/c/e6b2609af21b5cccc9559339591b8a2cbf884169","https://git.kernel.org/stable/c/761fcf46a1bd797bd32d23f3ea0141ffd437668a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71197","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-71197","identifiers":["CVE-2025-71197"]},"retained":false,"historicalAffected":[]}],"coverage":[]}