The Linux kernel's hardware monitoring subsystem for OCC sensors contains an out‑of‑bounds read bug. The parser for OCC poll responses walks a list of sensor data blocks using a static backing‑array size as a boundary, but the actual byte count of the transport response is only data_length. If the response is truncated, the parser may read beyond the valid bytes, potentially exposing kernel memory contents or causing a crash. This flaw can be triggered whenever an OCC device poll request is processed, and the memory corruption could lead to information disclosure or denial of service if the attacker can influence the sensor data. The vulnerability was fixed by verifying data_length boundaries and performing complete block validation before publishing sensor metadata, and by propagating malformed‑response errors before activating the OCC.

This issue affects all Linux kernel variants that include the OCC hardware monitoring driver before the commit that introduced the boundary checks. The specific kernel versions impacted are not listed in the public data; any kernel release that shipped the C implementation referenced in the linked commits is vulnerable until the patch is applied.

The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 7.7 denotes high severity. The attack vector is inferred to be local or remote with direct access to trigger an OCC sensor poll, such as an attacker with privileges to initiate hardware monitoring queries or a compromised firmware that can influence the response length. Given the kernel context, a successful exploitation could lead to a system crash or leakage of sensitive data stored in kernel memory.