Impact
The Linux kernel’s sht3x hardware monitoring driver extracts 16‑bit temperature and humidity values from a stack buffer using be16_to_cpup() on pointers that are not guaranteed to be properly aligned. Because the pointers are offset by an odd number of bytes, at least one reference is unaligned. On strict‑alignment architectures such as ARMv5 or SPARC, this misaligned read triggers an alignment fault that causes the kernel to panic. The resulting crash interrupts all processes, producing a loss of system availability. The flaw does not provide direct information disclosure or code execution, but it is a clear denial‑of‑service condition.
Affected Systems
Linux kernel releases that ship the sht3x hwmon driver prior to the applied patch are potentially impacted. Systems operating on strict‑alignment architectures—most notably ARMv5 and SPARC—are at risk. Any machine that loads the faulty firmware module in a kernel containing the unmodified sht3x_update_client() logic falls into this affected population.
Risk and Exploitability
The vulnerability carries a high severity due to its ability to crash the entire system. Based on the description, it is inferred that an attacker can trigger the fault by interacting with the sensor device, for example through sysfs entries or by invoking the driver’s read routines from user space. No EPSS score is available, so exploitation frequency is unknown. The issue is not listed in the CISA KEV catalog, suggesting no widespread public exploitation has been observed. Nevertheless, because unaligned accesses can be induced by normal sensor activity, administrators should treat the flaw as a high‑risk denial‑of‑service vulnerability.
OpenCVE Enrichment