CVE-2026-80695: hwmon: (sht3x) Fix unaligned accesses
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (sht3x) Fix unaligned accesses
Sashiko reports:
In sht3xupdateclient(), the 16-bit temperature and humidity values are extracted from a stack-allocated byte array using be16tocpup(). The pointers passed to this function are calculated as buf and buf + 3. Since the difference between the two pointers is an odd number of bytes, at least one of them is guaranteed to be at an unaligned offset.
This will trigger an alignment fault on strict-alignment architectures such as ARMv5 or SPARC, resulting in a kernel panic.
Fix the problem by using getunalignedbe16() instead of be16tocpup(), and putunalignedbe16() instead of cputobe16().
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In sht3x_update_client(), replace be16_to_cpup() when extracting the 16-bit temperature and humidity values from the stack-allocated byte array with get_unaligned_be16() to avoid alignment faults on strict-alignment architectures.
Linux kernel (hwmon: sht3x) Use get_unaligned_be16() instead of be16_to_cpup() = get_unaligned_be16() - Configuration
In the sht3x driver, replace cpu_to_be16() with put_unaligned_be16() to ensure 16-bit values are written safely to potentially unaligned buffer offsets.
Linux kernel (hwmon: sht3x) Use put_unaligned_be16() instead of cpu_to_be16() = put_unaligned_be16()
Event History
Frequently Asked Questions
Which systems are most likely to be affected by this issue?
Systems using the Linux sht3x hardware-monitoring driver on strict-alignment architectures, such as ARMv5 or SPARC, are affected. On those architectures, the unaligned temperature or humidity accesses can cause an alignment fault and kernel panic.
What conditions trigger the kernel panic?
The issue occurs when sht3x_update_client() reads the 16-bit temperature and humidity values from its byte buffer using pointers at offsets that are not guaranteed to be aligned. At least one access is necessarily unaligned because the values are read at offsets separated by three bytes.
What is the practical impact if the vulnerable code is reached?
A strict-alignment architecture can raise an alignment fault, resulting in a kernel panic. The described impact is denial of service through system crash.