Linux kernel occ hwmon: truncated OCC poll response is parsed past the valid data

Impact

The OCC poll response parser walks a counted list of sensor blocks using the static backing-array capacity as its boundary, but only data_length bytes of a transport response are actually current and valid. A truncated response therefore lets the parser consume a block header or a block extent that lies outside the response, an out-of-bounds read; the record's vector also carries a high availability impact. This driver is how IBM POWER systems surface processor power and thermal telemetry from the On-Chip Controller to the management stack. On a GPU or HPC node that telemetry is the input to power capping and cooling decisions, so the operational consequence of a bad parse is losing or corrupting the power/thermal picture for a machine, not a tenant-visible compromise.

Who can reach it

Not network-facing and not reachable by a tenant. It requires the OCC transport (FSI/SBE or I2C, depending on platform) to hand back a truncated or malformed poll response — a misbehaving or compromised OCC, or transport-level errors. No authentication boundary is crossed.

What to do

The record is a set of kernel commits, not a platform advisory: it does not say which service-processor or system firmware releases carry the fix. Track your platform vendor's firmware release notes and take the image that includes it. In practice this lands as a service-processor/BMC firmware update, which interrupts out-of-band management while it applies; confirm against your vendor's procedure whether a host outage is required before scheduling.

References