Linux Kernel EUVD-2026-55441

The On-Chip Controller (OCC) is management firmware embedded in IBM POWER processors, responsible for power and thermal telemetry. The Linux kernel interfaces with it through a polling driver in drivers/hwmon/occ/, which walks a counted list of sensor data blocks in the firmware's poll response. The vulnerable code used the static backing-array size as the parse loop boundary rather than the data_length value embedded in the response header. This is a classic unchecked-length over-read: if the firmware sends a truncated reply - whether due to firmware bugs, transport corruption, or a malicious BMC - the parser advances beyond the valid response buffer, reading block headers or extents from uninitialized or adjacent kernel memory. The fix, applied across five stable-tree backport commits, adds explicit data_length boundary proofs before reading any block header or extent, defers publishing parsed sensor metadata until the full response passes validation, and propagates malformed-response errors before marking the OCC active. While no CWE was formally assigned, CWE-125 (Out-of-bounds Read) and CWE-20 (Improper Input Validation) are the applicable root-cause classes. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.