{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-68340", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.384Z", "datePublished": "2026-08-10T12:03:16.552Z", "dateUpdated": "2026-08-19T16:33:40.900Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:33:40.900Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: occ: validate poll response sensor blocks\n\nThe OCC poll response parser walks a counted list of sensor data blocks.\nIt used the static backing-array capacity as the parse boundary, but a\ntransport response makes only data_length bytes current and valid. A\ntruncated response can therefore make the parser consume a block header or\nblock extent outside the current response.\n\nUse data_length as the parent boundary, prove the fixed poll header and\neach current block header before reading them, and prove the complete block\nbefore advancing. Keep parsed sensor metadata local until the complete\nresponse has passed validation, then publish it. Propagate\nmalformed-response errors before publishing the OCC as active." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.7, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The malformed poll response reaches the BMC kernel over the local FSI/SBE or I2C link to the attached POWER OCC (drivers/hwmon/occ/p9_sbe.c, p8_i2c.c); there is no network protocol involved, but no physical access is needed either since a bare-metal host-side attacker can drive OCC firmware in software.\nAC:L - The attacker fully controls the response contents and its data_length, so simply returning a truncated poll response with a large num_sensor_data_blocks deterministically drives the parser past the valid data. No race, memory-layout guess, or uncontrolled precondition is involved.\nPR:N - occ_setup() calls occ_active(occ, true) during driver probe unless ibm,no-poll-on-init is set, so the malformed response is parsed automatically at bind with no credentials on the affected BMC system; the OCC-side attacker holds no privileges in the victim kernel's authority.\nUI:N - Parsing happens automatically during driver probe, or from the management daemon's periodic occ_active write; no victim action such as mounting or opening a file is required.\nS:U - The out-of-bounds reads and corrupted sensor metadata are confined to the kernel that parses the response; no IOMMU, hypervisor, or sandbox boundary is crossed by the impact itself.\nC:H - Sensor metadata (data pointer, num_sensors, version) is taken from bytes outside the valid response, and consumers index it with fixed per-version struct sizes in occ_setup_sensor_attrs() and every occ_show_* handler, reading far past the devm-allocated occ object and exposing kernel heap contents through world-readable hwmon sysfs attributes.\nI:N - The parse path only reads; the unvalidated lengths yield out-of-bounds loads and bogus metadata, but no attacker-controlled data is written outside any object and no control-flow-hijack primitive is created.\nA:H - Out-of-bounds reads of up to a couple of kilobytes past the allocation can hit unmapped memory or trip KASAN/BUG and oops the kernel, and pre-fix the OCC was marked active with invalid sensor state, leaving the hwmon device in an inconsistent, unusable condition." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/hwmon/occ/common.c" ], "versions": [ { "version": "aa195fe49b033db545ad986cdb2c431c37bea557", "lessThan": "6e6c72c37433640514db325408bd6913ad28fe69", "status": "affected", "versionType": "git" }, { "version": "aa195fe49b033db545ad986cdb2c431c37bea557", "lessThan": "1902e9572901d37901e3db1f3f6b0885f4e49a66", "status": "affected", "versionType": "git" }, { "version": "aa195fe49b033db545ad986cdb2c431c37bea557", "lessThan": "112525534ab5cff482d35897ca4ca11fd3a76f46", "status": "affected", "versionType": "git" }, { "version": "aa195fe49b033db545ad986cdb2c431c37bea557", "lessThan": "54cb78eceb4e286ccd5a5c01a4632157860d47f0", "status": "affected", "versionType": "git" }, { "version": "aa195fe49b033db545ad986cdb2c431c37bea557", "lessThan": "538d862cc0dbd5c732fe26d5aad98eae039e6676", "status": "affected", "versionType": "git" }, { "version": "aa195fe49b033db545ad986cdb2c431c37bea557", "lessThan": "b042e538e98b939fccfffc464e2c34c29f0e96ef", "status": "affected", "versionType": "git" }, { "version": "aa195fe49b033db545ad986cdb2c431c37bea557", "lessThan": "70e76e700fc6c46afb4e17aec099a1ea089b4a22", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/hwmon/occ/common.c" ], "versions": [ { "version": "5.0", "status": "affected" }, { "version": "0", "lessThan": "5.0", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.15.216" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.1.183" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.6.148" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.12.101" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.18.42" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "7.1.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/6e6c72c37433640514db325408bd6913ad28fe69" }, { "url": "https://git.kernel.org/stable/c/1902e9572901d37901e3db1f3f6b0885f4e49a66" }, { "url": "https://git.kernel.org/stable/c/112525534ab5cff482d35897ca4ca11fd3a76f46" }, { "url": "https://git.kernel.org/stable/c/54cb78eceb4e286ccd5a5c01a4632157860d47f0" }, { "url": "https://git.kernel.org/stable/c/538d862cc0dbd5c732fe26d5aad98eae039e6676" }, { "url": "https://git.kernel.org/stable/c/b042e538e98b939fccfffc464e2c34c29f0e96ef" }, { "url": "https://git.kernel.org/stable/c/70e76e700fc6c46afb4e17aec099a1ea089b4a22" } ], "title": "hwmon: occ: validate poll response sensor blocks", "x_generator": { "engine": "bippy-1.2.0" } } } }