Description
In the Linux kernel, the following vulnerability has been resolved:

hwmon: (sht3x) Fix unaligned accesses

Sashiko reports:

In sht3x_update_client(), the 16-bit temperature and humidity values are
extracted from a stack-allocated byte array using be16_to_cpup(). The
pointers passed to this function are calculated as buf and buf + 3. Since
the difference between the two pointers is an odd number of bytes, at
least one of them is guaranteed to be at an unaligned offset.

This will trigger an alignment fault on strict-alignment architectures
such as ARMv5 or SPARC, resulting in a kernel panic.

Fix the problem by using get_unaligned_be16() instead of be16_to_cpup(),
and put_unaligned_be16() instead of cpu_to_be16().
Published: 2026-08-28
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Linux kernel’s sht3x hardware monitoring driver extracts 16‑bit temperature and humidity values from a stack buffer using be16_to_cpup() on pointers that are not guaranteed to be properly aligned. Because the pointers are offset by an odd number of bytes, at least one reference is unaligned. On strict‑alignment architectures such as ARMv5 or SPARC, this misaligned read triggers an alignment fault that causes the kernel to panic. The resulting crash interrupts all processes, producing a loss of system availability. The flaw does not provide direct information disclosure or code execution, but it is a clear denial‑of‑service condition.

Affected Systems

Linux kernel releases that ship the sht3x hwmon driver prior to the applied patch are potentially impacted. Systems operating on strict‑alignment architectures—most notably ARMv5 and SPARC—are at risk. Any machine that loads the faulty firmware module in a kernel containing the unmodified sht3x_update_client() logic falls into this affected population.

Risk and Exploitability

The vulnerability carries a high severity due to its ability to crash the entire system. Based on the description, it is inferred that an attacker can trigger the fault by interacting with the sensor device, for example through sysfs entries or by invoking the driver’s read routines from user space. No EPSS score is available, so exploitation frequency is unknown. The issue is not listed in the CISA KEV catalog, suggesting no widespread public exploitation has been observed. Nevertheless, because unaligned accesses can be induced by normal sensor activity, administrators should treat the flaw as a high‑risk denial‑of‑service vulnerability.

Generated by OpenCVE AI on August 28, 2026 at 12:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the kernel to a version that includes the patch fixing the unaligned access in the sht3x driver.
  • If a kernel upgrade is not immediately feasible, disable or blacklist the sht3x device module so that the kernel does not attempt the faulty read.
  • Apply a manual code patch by replacing be16_to_cpup() with get_unaligned_be16() and cpu_to_be16() with put_unaligned_be16() in the sht3x_update_client() function.
  • Restrict access to the sensor’s sysfs interface to trusted users to reduce the likelihood that an unprivileged user can trigger a crash.

Generated by OpenCVE AI on August 28, 2026 at 12:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-704

Fri, 28 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: hwmon: (sht3x) Fix unaligned accesses Sashiko reports: In sht3x_update_client(), the 16-bit temperature and humidity values are extracted from a stack-allocated byte array using be16_to_cpup(). The pointers passed to this function are calculated as buf and buf + 3. Since the difference between the two pointers is an odd number of bytes, at least one of them is guaranteed to be at an unaligned offset. This will trigger an alignment fault on strict-alignment architectures such as ARMv5 or SPARC, resulting in a kernel panic. Fix the problem by using get_unaligned_be16() instead of be16_to_cpup(), and put_unaligned_be16() instead of cpu_to_be16().
Title hwmon: (sht3x) Fix unaligned accesses
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-28T06:53:01.037Z

Reserved: 2026-08-26T14:34:25.785Z

Link: CVE-2026-80695

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T08:16:54.983

Modified: 2026-08-28T08:16:54.983

Link: CVE-2026-80695

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T13:15:05Z

Weaknesses
  • CWE-704

    Incorrect Type Conversion or Cast