CVE-2026-68340

A flaw was found in the Linux kernel's hwmon OCC (OpenPOWER Abbreviated Command and Control) poll response parser. This vulnerability occurs because the parser incorrectly uses a static array capacity as the boundary for sensor data blocks instead of the actual data length. A specially crafted, truncated response could cause the parser to read data beyond the intended buffer, potentially leading to memory corruption or a denial of service.

This vulnerability poses no risk to supported Red Hat Enterprise Linux releases because the affected OpenPOWER hardware monitoring subsystem code is not present in enterprise kernels. In platforms where this driver is utilized, triggering the issue requires malformed or truncated responses from the On-Chip Controller, which could lead to an out-of-bounds read condition resulting in a system crash. Consequently, standard Red Hat environments do not face exposure from this flaw.