CVE-2026-31770: Linux Kernel hwmon (occ) DoS Vulnerability

CVE-2026-31770 Overview

CVE-2026-31770 is a division-by-zero flaw in the Linux kernel's hwmon On-Chip Controller (OCC) driver. The defect resides in the occ_show_power_1() function, which divides the accumulator value by update_tag without first validating that the divisor is non-zero. When the sensor block is present but no samples have been collected, such as during early boot, update_tag remains zero. Reading the affected sysfs power attribute then triggers a kernel divide-by-zero exception. The issue affects Linux systems using the OCC hwmon driver, primarily IBM POWER platforms exposing power telemetry.

Critical Impact
A local read of an OCC power sensor sysfs file before the first sample arrives can crash the kernel, producing a denial-of-service condition on affected systems.

Affected Products

Linux kernel builds enabling the hwmon OCC driver (drivers/hwmon/occ)
IBM POWER systems exposing OCC power telemetry via sysfs
Stable kernel branches prior to the fixes referenced in the upstream commits

Discovery Timeline

2026-05-01 - CVE-2026-31770 published to NVD
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-31770

Vulnerability Analysis

The Linux kernel hwmon OCC driver exposes power sensor readings through sysfs attributes. In occ_show_power_1() case 1, the code computes an average by dividing the accumulator by update_tag, which represents the number of samples collected. The function omits a zero check on update_tag. If userspace reads the attribute before any samples have accumulated, the kernel performs an integer divide-by-zero, raising a CPU exception and panicking the affected code path. A 2019 fix in commit 211186cae14d corrected an analogous issue in occ_get_powr_avg() used by occ_show_power_2() and occ_show_power_a0(), but the parallel code path in occ_show_power_1() was overlooked. This vulnerability is classified as a Denial of Service via Division by Zero in kernel space.

Root Cause

The root cause is missing input validation on the update_tag divisor in occ_show_power_1(). The driver assumes at least one sample has been collected before the sysfs read, an assumption that does not hold during early boot or before the OCC sensor block has been refreshed. The accumulator math executes unconditionally, and the kernel does not catch the zero divisor before issuing the divide instruction.

Attack Vector

A local user or process with permission to read OCC power sysfs attributes can trigger the crash by reading the relevant power node before the sensor has been updated. No special privileges beyond standard sysfs read access are required if attribute permissions allow it. The result is a kernel-level fault rather than memory corruption or privilege escalation. EPSS scoring places exploitation likelihood low at the time of publication, consistent with the local DoS profile.

Code-level details are available in the upstream commits, including Kernel Git Commit 243d55b, Kernel Git Commit 2502684b, and Kernel Git Commit 7b89ce0c.

Detection Methods for CVE-2026-31770

Indicators of Compromise

Kernel oops or panic messages referencing divide error and occ_show_power_1 in the call stack from dmesg or /var/log/kern.log.
Unexpected reboots or service interruptions on IBM POWER systems shortly after boot when monitoring tools poll OCC hwmon attributes.
Repeated process crashes for monitoring agents (for example, lm-sensors, collectd, prometheus-node-exporter) reading OCC power nodes.

Detection Strategies

Inventory running kernels against the fixed commit hashes listed in the upstream stable tree to identify unpatched hosts.
Audit which processes and users have read access to /sys/class/hwmon/*/power*_input on POWER hosts to scope exposure.
Correlate kernel panics with timestamps of monitoring agent polling cycles to confirm the trigger pattern.

Monitoring Recommendations

Forward kernel logs to a central log aggregation or SIEM platform and alert on divide_error or Oops strings tied to hwmon or occ_* symbols.
Track host availability metrics on POWER fleets to surface unexplained reboots that may map to this defect.
Monitor sensor polling configurations to ensure they do not run before the OCC driver has produced its first sample.

How to Mitigate CVE-2026-31770

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the commits in the NVD entry to all affected stable branches.
Reboot hosts after the kernel update so the corrected occ driver is loaded.
Restrict read access to OCC hwmon sysfs attributes to trusted monitoring accounts until patches are deployed.

Patch Information

The fix replaces the unchecked division in occ_show_power_1() by reusing the existing occ_get_powr_avg() helper, which already handles the zero-sample case and uses mul_u64_u32_div() to multiply before dividing for improved precision. The helper is moved above occ_show_power_1() so it is visible at the call site. Patched kernels are available through the stable tree commits, including Kernel Git Commit 37ae8fad, Kernel Git Commit 39e2a5bf, Kernel Git Commit 53e61757, Kernel Git Commit bbbefc48, and Kernel Git Commit c7d37123. Distribution-specific kernel updates should be tracked through each vendor's advisory channels.

Workarounds

Unload the OCC hwmon driver (modprobe -r occ) on systems that do not require power telemetry until a patched kernel is installed.
Delay sensor polling until after system boot completes and the OCC driver has produced at least one sample.
Tighten Unix permissions on /sys/class/hwmon/*/power*_input so only trusted monitoring accounts can read the attribute.

bash

# Configuration example: blacklist the OCC hwmon module pending patch deployment
echo "blacklist occ_hwmon" | sudo tee /etc/modprobe.d/blacklist-occ.conf
sudo modprobe -r occ_hwmon 2>/dev/null || true
sudo update-initramfs -u