Linux kernel occ hwmon: truncated OCC poll response is parsed past the valid data

CVSS 7.7CVE-2026-68340Firmware, BMC & network fabriccurated

Impact

The OCC poll response parser walks a counted list of sensor blocks using the static backing-array capacity as its boundary, but only data_length bytes of a transport response are actually current and valid. A truncated response therefore lets the parser consume a block header or a block extent that lies outside the response, an out-of-bounds read; the record's vector also carries a high availability impact. This driver is how IBM POWER systems surface processor power and thermal telemetry from the On-Chip Controller to the management stack. On a GPU or HPC node that telemetry is the input to power capping and cooling decisions, so the operational consequence of a bad parse is losing or corrupting the power/thermal picture for a machine, not a tenant-visible compromise.

Who can reach it

Not network-facing and not reachable by a tenant. It requires the OCC transport (FSI/SBE or I2C, depending on platform) to hand back a truncated or malformed poll response — a misbehaving or compromised OCC, or transport-level errors. No authentication boundary is crossed.

What to do

The record is a set of kernel commits, not a platform advisory: it does not say which service-processor or system firmware releases carry the fix. Track your platform vendor's firmware release notes and take the image that includes it. In practice this lands as a service-processor/BMC firmware update, which interrupts out-of-band management while it applies; confirm against your vendor's procedure whether a host outage is required before scheduling.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-68340 https://git.kernel.org/stable/c/112525534ab5cff482d35897ca4ca11fd3a76f46 https://git.kernel.org/stable/c/538d862cc0dbd5c732fe26d5aad98eae039e6676 https://git.kernel.org/stable/c/6e6c72c37433640514db325408bd6913ad28fe69

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.