{"api_version":"1","generated_at":"2026-08-14T09:58:00+00:00","cve":"CVE-2026-68340","urls":{"html":"https://cve.report/CVE-2026-68340","api":"https://cve.report/api/cve/CVE-2026-68340.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-68340","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-68340"},"summary":{"title":"hwmon: occ: validate poll response sensor blocks","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: occ: validate poll response sensor blocks\n\nThe OCC poll response parser walks a counted list of sensor data blocks.\nIt used the static backing-array capacity as the parse boundary, but a\ntransport response makes only data_length bytes current and valid. A\ntruncated response can therefore make the parser consume a block header or\nblock extent outside the current response.\n\nUse data_length as the parent boundary, prove the fixed poll header and\neach current block header before reading them, and prove the complete block\nbefore advancing. Keep parsed sensor metadata local until the complete\nresponse has passed validation, then publish it. Propagate\nmalformed-response errors before publishing the OCC as active.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-10 13:20:24","updated_at":"2026-08-13 23:17:31"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.7","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.7","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","data":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/54cb78eceb4e286ccd5a5c01a4632157860d47f0","name":"https://git.kernel.org/stable/c/54cb78eceb4e286ccd5a5c01a4632157860d47f0","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/70e76e700fc6c46afb4e17aec099a1ea089b4a22","name":"https://git.kernel.org/stable/c/70e76e700fc6c46afb4e17aec099a1ea089b4a22","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b042e538e98b939fccfffc464e2c34c29f0e96ef","name":"https://git.kernel.org/stable/c/b042e538e98b939fccfffc464e2c34c29f0e96ef","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/538d862cc0dbd5c732fe26d5aad98eae039e6676","name":"https://git.kernel.org/stable/c/538d862cc0dbd5c732fe26d5aad98eae039e6676","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/112525534ab5cff482d35897ca4ca11fd3a76f46","name":"https://git.kernel.org/stable/c/112525534ab5cff482d35897ca4ca11fd3a76f46","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68340","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68340","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected aa195fe49b033db545ad986cdb2c431c37bea557 112525534ab5cff482d35897ca4ca11fd3a76f46 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected aa195fe49b033db545ad986cdb2c431c37bea557 54cb78eceb4e286ccd5a5c01a4632157860d47f0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected aa195fe49b033db545ad986cdb2c431c37bea557 538d862cc0dbd5c732fe26d5aad98eae039e6676 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected aa195fe49b033db545ad986cdb2c431c37bea557 b042e538e98b939fccfffc464e2c34c29f0e96ef git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected aa195fe49b033db545ad986cdb2c431c37bea557 70e76e700fc6c46afb4e17aec099a1ea089b4a22 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.0","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.0 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.148 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.101 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.42 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.6 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2-rc5 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"68340","cve":"CVE-2026-68340","epss":"0.001750000","percentile":"0.072340000","score_date":"2026-08-13","updated_at":"2026-08-14 00:07:35"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hwmon/occ/common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"112525534ab5cff482d35897ca4ca11fd3a76f46","status":"affected","version":"aa195fe49b033db545ad986cdb2c431c37bea557","versionType":"git"},{"lessThan":"54cb78eceb4e286ccd5a5c01a4632157860d47f0","status":"affected","version":"aa195fe49b033db545ad986cdb2c431c37bea557","versionType":"git"},{"lessThan":"538d862cc0dbd5c732fe26d5aad98eae039e6676","status":"affected","version":"aa195fe49b033db545ad986cdb2c431c37bea557","versionType":"git"},{"lessThan":"b042e538e98b939fccfffc464e2c34c29f0e96ef","status":"affected","version":"aa195fe49b033db545ad986cdb2c431c37bea557","versionType":"git"},{"lessThan":"70e76e700fc6c46afb4e17aec099a1ea089b4a22","status":"affected","version":"aa195fe49b033db545ad986cdb2c431c37bea557","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hwmon/occ/common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.0"},{"lessThan":"5.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.148","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2-rc5","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.148","versionStartIncluding":"5.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.101","versionStartIncluding":"5.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.42","versionStartIncluding":"5.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.6","versionStartIncluding":"5.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2-rc5","versionStartIncluding":"5.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: occ: validate poll response sensor blocks\n\nThe OCC poll response parser walks a counted list of sensor data blocks.\nIt used the static backing-array capacity as the parse boundary, but a\ntransport response makes only data_length bytes current and valid. A\ntruncated response can therefore make the parser consume a block header or\nblock extent outside the current response.\n\nUse data_length as the parent boundary, prove the fixed poll header and\neach current block header before reading them, and prove the complete block\nbefore advancing. Keep parsed sensor metadata local until the complete\nresponse has passed validation, then publish it. Propagate\nmalformed-response errors before publishing the OCC as active."}],"metrics":[{"cvssV3_1":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The malformed poll response reaches the BMC kernel over the local FSI/SBE or I2C link to the attached POWER OCC (drivers/hwmon/occ/p9_sbe.c, p8_i2c.c); there is no network protocol involved, but no physical access is needed either since a bare-metal host-side attacker can drive OCC firmware in software.\nAC:L - The attacker fully controls the response contents and its data_length, so simply returning a truncated poll response with a large num_sensor_data_blocks deterministically drives the parser past the valid data. No race, memory-layout guess, or uncontrolled precondition is involved.\nPR:N - occ_setup() calls occ_active(occ, true) during driver probe unless ibm,no-poll-on-init is set, so the malformed response is parsed automatically at bind with no credentials on the affected BMC system; the OCC-side attacker holds no privileges in the victim kernel's authority.\nUI:N - Parsing happens automatically during driver probe, or from the management daemon's periodic occ_active write; no victim action such as mounting or opening a file is required.\nS:U - The out-of-bounds reads and corrupted sensor metadata are confined to the kernel that parses the response; no IOMMU, hypervisor, or sandbox boundary is crossed by the impact itself.\nC:H - Sensor metadata (data pointer, num_sensors, version) is taken from bytes outside the valid response, and consumers index it with fixed per-version struct sizes in occ_setup_sensor_attrs() and every occ_show_* handler, reading far past the devm-allocated occ object and exposing kernel heap contents through world-readable hwmon sysfs attributes.\nI:N - The parse path only reads; the unvalidated lengths yield out-of-bounds loads and bogus metadata, but no attacker-controlled data is written outside any object and no control-flow-hijack primitive is created.\nA:H - Out-of-bounds reads of up to a couple of kilobytes past the allocation can hit unmapped memory or trip KASAN/BUG and oops the kernel, and pre-fix the OCC was marked active with invalid sensor state, leaving the hwmon device in an inconsistent, unusable condition."}]}],"providerMetadata":{"dateUpdated":"2026-08-13T22:43:32.057Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/112525534ab5cff482d35897ca4ca11fd3a76f46"},{"url":"https://git.kernel.org/stable/c/54cb78eceb4e286ccd5a5c01a4632157860d47f0"},{"url":"https://git.kernel.org/stable/c/538d862cc0dbd5c732fe26d5aad98eae039e6676"},{"url":"https://git.kernel.org/stable/c/b042e538e98b939fccfffc464e2c34c29f0e96ef"},{"url":"https://git.kernel.org/stable/c/70e76e700fc6c46afb4e17aec099a1ea089b4a22"}],"title":"hwmon: occ: validate poll response sensor blocks","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-68340","datePublished":"2026-08-10T12:03:16.552Z","dateReserved":"2026-07-30T09:28:09.384Z","dateUpdated":"2026-08-13T22:43:32.057Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-10 13:20:24","lastModifiedDate":"2026-08-13 23:17:31","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"68340","Ordinal":"1","Title":"hwmon: occ: validate poll response sensor blocks","CVE":"CVE-2026-68340","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"68340","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: occ: validate poll response sensor blocks\n\nThe OCC poll response parser walks a counted list of sensor data blocks.\nIt used the static backing-array capacity as the parse boundary, but a\ntransport response makes only data_length bytes current and valid. A\ntruncated response can therefore make the parser consume a block header or\nblock extent outside the current response.\n\nUse data_length as the parent boundary, prove the fixed poll header and\neach current block header before reading them, and prove the complete block\nbefore advancing. Keep parsed sensor metadata local until the complete\nresponse has passed validation, then publish it. Propagate\nmalformed-response errors before publishing the OCC as active.","Type":"Description","Title":"hwmon: occ: validate poll response sensor blocks"}]}}}