CVE-2026-68340
hwmon: occ: validate poll response sensor blocks
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: occ: validate poll response sensor blocks The OCC poll response parser walks a counted list of sensor data blocks. It used the static backing-array capacity as the parse boundary, but a transport response makes only data_length bytes current and valid. A truncated response can therefore make the parser consume a block header or block extent outside the current response. Use data_length as the parent boundary, prove the fixed poll header and each current block header before reading them, and prove the complete block before advancing. Keep parsed sensor metadata local until the complete response has passed validation, then publish it. Propagate malformed-response errors before publishing the OCC as active.
Timeline
ID reserved
By Linux
- 11 days later
· 11 days later
Published
- 9 days later
· 9 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.7 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| NVDNVD · Received | 3.1 | High7.7 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.15% · top 96% of all CVEs (8 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.7.
Affected products
- affected aa195fe49b033db545ad986cdb2c431c37bea557 – < 6e6c72c37433640514db325408bd6913ad28fe69
- affected aa195fe49b033db545ad986cdb2c431c37bea557 – < 1902e9572901d37901e3db1f3f6b0885f4e49a66
- affected aa195fe49b033db545ad986cdb2c431c37bea557 – < 112525534ab5cff482d35897ca4ca11fd3a76f46
- affected aa195fe49b033db545ad986cdb2c431c37bea557 – < 54cb78eceb4e286ccd5a5c01a4632157860d47f0
- affected aa195fe49b033db545ad986cdb2c431c37bea557 – < 538d862cc0dbd5c732fe26d5aad98eae039e6676
- affected aa195fe49b033db545ad986cdb2c431c37bea557 – < b042e538e98b939fccfffc464e2c34c29f0e96ef
- affected aa195fe49b033db545ad986cdb2c431c37bea557 – < 70e76e700fc6c46afb4e17aec099a1ea089b4a22
- affected 5.0
- unaffected < 5.0
- unaffected 5.15.216 – ≤ 5.15.*
- unaffected 6.1.183 – ≤ 6.1.*
- unaffected 6.6.148 – ≤ 6.6.*
- unaffected 6.12.101 – ≤ 6.12.*
- unaffected 6.18.42 – ≤ 6.18.*
- unaffected 7.1.6 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References (7)
- https://git.kernel.org/stable/c/6e6c72c37433640514db325408bd6913ad28fe69 (opens in a new tab)
- https://git.kernel.org/stable/c/1902e9572901d37901e3db1f3f6b0885f4e49a66 (opens in a new tab)
- https://git.kernel.org/stable/c/112525534ab5cff482d35897ca4ca11fd3a76f46 (opens in a new tab)
- https://git.kernel.org/stable/c/54cb78eceb4e286ccd5a5c01a4632157860d47f0 (opens in a new tab)
- https://git.kernel.org/stable/c/538d862cc0dbd5c732fe26d5aad98eae039e6676 (opens in a new tab)
- https://git.kernel.org/stable/c/b042e538e98b939fccfffc464e2c34c29f0e96ef (opens in a new tab)
- https://git.kernel.org/stable/c/70e76e700fc6c46afb4e17aec099a1ea089b4a22 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-68340)Record last updated .