CVE-2026-68340 (GCVE-0-2026-68340)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:03 – Updated: 2026-08-19 16:33
VLAI
Title
hwmon: occ: validate poll response sensor blocks
Summary
In the Linux kernel, the following vulnerability has been resolved: hwmon: occ: validate poll response sensor blocks The OCC poll response parser walks a counted list of sensor data blocks. It used the static backing-array capacity as the parse boundary, but a transport response makes only data_length bytes current and valid. A truncated response can therefore make the parser consume a block header or block extent outside the current response. Use data_length as the parent boundary, prove the fixed poll header and each current block header before reading them, and prove the complete block before advancing. Keep parsed sensor metadata local until the complete response has passed validation, then publish it. Propagate malformed-response errors before publishing the OCC as active.
Severity
7.7 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: aa195fe49b033db545ad986cdb2c431c37bea557 , < 6e6c72c37433640514db325408bd6913ad28fe69 (git)
Affected: aa195fe49b033db545ad986cdb2c431c37bea557 , < 1902e9572901d37901e3db1f3f6b0885f4e49a66 (git)
Affected: aa195fe49b033db545ad986cdb2c431c37bea557 , < 112525534ab5cff482d35897ca4ca11fd3a76f46 (git)
Affected: aa195fe49b033db545ad986cdb2c431c37bea557 , < 54cb78eceb4e286ccd5a5c01a4632157860d47f0 (git)
Affected: aa195fe49b033db545ad986cdb2c431c37bea557 , < 538d862cc0dbd5c732fe26d5aad98eae039e6676 (git)
Affected: aa195fe49b033db545ad986cdb2c431c37bea557 , < b042e538e98b939fccfffc464e2c34c29f0e96ef (git)
Affected: aa195fe49b033db545ad986cdb2c431c37bea557 , < 70e76e700fc6c46afb4e17aec099a1ea089b4a22 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.0
Unaffected: 0 , < 5.0 (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/occ/common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6e6c72c37433640514db325408bd6913ad28fe69",
              "status": "affected",
              "version": "aa195fe49b033db545ad986cdb2c431c37bea557",
              "versionType": "git"
            },
            {
              "lessThan": "1902e9572901d37901e3db1f3f6b0885f4e49a66",
              "status": "affected",
              "version": "aa195fe49b033db545ad986cdb2c431c37bea557",
              "versionType": "git"
            },
            {
              "lessThan": "112525534ab5cff482d35897ca4ca11fd3a76f46",
              "status": "affected",
              "version": "aa195fe49b033db545ad986cdb2c431c37bea557",
              "versionType": "git"
            },
            {
              "lessThan": "54cb78eceb4e286ccd5a5c01a4632157860d47f0",
              "status": "affected",
              "version": "aa195fe49b033db545ad986cdb2c431c37bea557",
              "versionType": "git"
            },
            {
              "lessThan": "538d862cc0dbd5c732fe26d5aad98eae039e6676",
              "status": "affected",
              "version": "aa195fe49b033db545ad986cdb2c431c37bea557",
              "versionType": "git"
            },
            {
              "lessThan": "b042e538e98b939fccfffc464e2c34c29f0e96ef",
              "status": "affected",
              "version": "aa195fe49b033db545ad986cdb2c431c37bea557",
              "versionType": "git"
            },
            {
              "lessThan": "70e76e700fc6c46afb4e17aec099a1ea089b4a22",
              "status": "affected",
              "version": "aa195fe49b033db545ad986cdb2c431c37bea557",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/occ/common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: occ: validate poll response sensor blocks\n\nThe OCC poll response parser walks a counted list of sensor data blocks.\nIt used the static backing-array capacity as the parse boundary, but a\ntransport response makes only data_length bytes current and valid. A\ntruncated response can therefore make the parser consume a block header or\nblock extent outside the current response.\n\nUse data_length as the parent boundary, prove the fixed poll header and\neach current block header before reading them, and prove the complete block\nbefore advancing. Keep parsed sensor metadata local until the complete\nresponse has passed validation, then publish it. Propagate\nmalformed-response errors before publishing the OCC as active."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The malformed poll response reaches the BMC kernel over the local FSI/SBE or I2C link to the attached POWER OCC (drivers/hwmon/occ/p9_sbe.c, p8_i2c.c); there is no network protocol involved, but no physical access is needed either since a bare-metal host-side attacker can drive OCC firmware in software.\nAC:L - The attacker fully controls the response contents and its data_length, so simply returning a truncated poll response with a large num_sensor_data_blocks deterministically drives the parser past the valid data. No race, memory-layout guess, or uncontrolled precondition is involved.\nPR:N - occ_setup() calls occ_active(occ, true) during driver probe unless ibm,no-poll-on-init is set, so the malformed response is parsed automatically at bind with no credentials on the affected BMC system; the OCC-side attacker holds no privileges in the victim kernel\u0027s authority.\nUI:N - Parsing happens automatically during driver probe, or from the management daemon\u0027s periodic occ_active write; no victim action such as mounting or opening a file is required.\nS:U - The out-of-bounds reads and corrupted sensor metadata are confined to the kernel that parses the response; no IOMMU, hypervisor, or sandbox boundary is crossed by the impact itself.\nC:H - Sensor metadata (data pointer, num_sensors, version) is taken from bytes outside the valid response, and consumers index it with fixed per-version struct sizes in occ_setup_sensor_attrs() and every occ_show_* handler, reading far past the devm-allocated occ object and exposing kernel heap contents through world-readable hwmon sysfs attributes.\nI:N - The parse path only reads; the unvalidated lengths yield out-of-bounds loads and bogus metadata, but no attacker-controlled data is written outside any object and no control-flow-hijack primitive is created.\nA:H - Out-of-bounds reads of up to a couple of kilobytes past the allocation can hit unmapped memory or trip KASAN/BUG and oops the kernel, and pre-fix the OCC was marked active with invalid sensor state, leaving the hwmon device in an inconsistent, unusable condition."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:33:40.900Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6e6c72c37433640514db325408bd6913ad28fe69"
        },
        {
          "url": "https://git.kernel.org/stable/c/1902e9572901d37901e3db1f3f6b0885f4e49a66"
        },
        {
          "url": "https://git.kernel.org/stable/c/112525534ab5cff482d35897ca4ca11fd3a76f46"
        },
        {
          "url": "https://git.kernel.org/stable/c/54cb78eceb4e286ccd5a5c01a4632157860d47f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/538d862cc0dbd5c732fe26d5aad98eae039e6676"
        },
        {
          "url": "https://git.kernel.org/stable/c/b042e538e98b939fccfffc464e2c34c29f0e96ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/70e76e700fc6c46afb4e17aec099a1ea089b4a22"
        }
      ],
      "title": "hwmon: occ: validate poll response sensor blocks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68340",
    "datePublished": "2026-08-10T12:03:16.552Z",
    "dateReserved": "2026-07-30T09:28:09.384Z",
    "dateUpdated": "2026-08-19T16:33:40.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68340",
      "date": "2026-08-20",
      "epss": "0.0015",
      "percentile": "0.04726"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68340\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:24.497\",\"lastModified\":\"2026-08-19T17:20:43.940\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nhwmon: occ: validate poll response sensor blocks\\n\\nThe OCC poll response parser walks a counted list of sensor data blocks.\\nIt used the static backing-array capacity as the parse boundary, but a\\ntransport response makes only data_length bytes current and valid. A\\ntruncated response can therefore make the parser consume a block header or\\nblock extent outside the current response.\\n\\nUse data_length as the parent boundary, prove the fixed poll header and\\neach current block header before reading them, and prove the complete block\\nbefore advancing. Keep parsed sensor metadata local until the complete\\nresponse has passed validation, then publish it. Propagate\\nmalformed-response errors before publishing the OCC as active.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/hwmon/occ/common.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"aa195fe49b033db545ad986cdb2c431c37bea557\",\"lessThan\":\"6e6c72c37433640514db325408bd6913ad28fe69\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa195fe49b033db545ad986cdb2c431c37bea557\",\"lessThan\":\"1902e9572901d37901e3db1f3f6b0885f4e49a66\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa195fe49b033db545ad986cdb2c431c37bea557\",\"lessThan\":\"112525534ab5cff482d35897ca4ca11fd3a76f46\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa195fe49b033db545ad986cdb2c431c37bea557\",\"lessThan\":\"54cb78eceb4e286ccd5a5c01a4632157860d47f0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa195fe49b033db545ad986cdb2c431c37bea557\",\"lessThan\":\"538d862cc0dbd5c732fe26d5aad98eae039e6676\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa195fe49b033db545ad986cdb2c431c37bea557\",\"lessThan\":\"b042e538e98b939fccfffc464e2c34c29f0e96ef\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aa195fe49b033db545ad986cdb2c431c37bea557\",\"lessThan\":\"70e76e700fc6c46afb4e17aec099a1ea089b4a22\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/hwmon/occ/common.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.148\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/112525534ab5cff482d35897ca4ca11fd3a76f46\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1902e9572901d37901e3db1f3f6b0885f4e49a66\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/538d862cc0dbd5c732fe26d5aad98eae039e6676\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/54cb78eceb4e286ccd5a5c01a4632157860d47f0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6e6c72c37433640514db325408bd6913ad28fe69\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/70e76e700fc6c46afb4e17aec099a1ea089b4a22\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b042e538e98b939fccfffc464e2c34c29f0e96ef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-08-11T13:30:03+00:00",
      "cve": "CVE-2026-68340",
      "id": "CVE-2026-68340",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: hwmon: occ: validate poll response sensor blocks",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68340.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-11T23:47:15Z",
      "cve": "CVE-2026-68340",
      "id": "CVE-2026-68340",
      "initial_release_date": "2026-08-11T23:47:15Z",
      "product_status:known_affected": "144",
      "product_status:known_not_affected": "152",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68340",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68340.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.