CVE-2026-68340

What it actually does

Out-of-bounds memory reads in the OCC poll response parser caused by using static backing-array capacity instead of the transport-provided data_length as the parse boundary on truncated responses, allowing consumption of headers or extents outside the current valid buffer.

Why it matters to the business

Local unprivileged processes can trigger kernel memory disclosure or crashes, leading to information leaks or denial of service on affected Linux systems.

How an attack unfolds

An attacker with local access crafts a truncated OCC poll transport response that reports a data_length smaller than the static array size; the parser then walks beyond valid data into adjacent memory while parsing sensor blocks, leaking kernel contents or causing faults.

How to fix it

Apply the upstream kernel fix that enforces data_length as the parent boundary, validates the poll header and each block header before use, and keeps parsed metadata private until the full response passes validation; rebuild and deploy the patched kernel.

How to confirm the fix worked

Confirm the fix is present by inspecting the hwmon/occ.c source for the data_length boundary checks and local-metadata publication logic, then verify the running kernel was built from a tree containing that change.

Typical attack path

1. Obtain local unprivileged execution on the target system
2. Interact with the hwmon OCC interface to trigger a poll response
3. Supply a malformed response with data_length that under-reports available bytes
4. Trigger parser walk that reads beyond the reported length
5. Observe resulting memory disclosure or kernel oops

How to detect it

Review kernel logs for oops or panic entries referencing occ_poll or hwmon sensor-block parsing; inspect audit logs for unusual local processes interacting with hwmon sysfs entries around the time of any crash.

What your security team should do

• Patch affected kernels with the validation fix at the earliest maintenance window
• Monitor upstream stable branches for the merged commit
• Limit unprivileged local access on systems exposing hwmon OCC sensors until patched