CVE-2026-80695 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (sht3x) Fix unaligned accesses
Sashiko reports:
In sht3x_update_client(), the 16-bit temperature and humidity values are extracted from a stack-allocated byte array using be16_to_cpup(). The pointers passed to this function are calculated as buf and buf + 3. Since the difference between the two pointers is an odd number of bytes, at least one of them is guaranteed to be at an unaligned offset.
This will trigger an alignment fault on strict-alignment architectures such as ARMv5 or SPARC, resulting in a kernel panic.
Fix the problem by using get_unaligned_be16() instead of be16_to_cpup(), and put_unaligned_be16() instead of cpu_to_be16().
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel hardware monitoring subsystem contains a critical alignment vulnerability within the sht3x driver, specifically affecting how 16-bit sensor data is extracted from memory buffers. The core issue resides in the sht3x_update_client function, which processes temperature and humidity readings received from SHT3X series sensors. These devices transmit data as byte arrays where multi-byte values are packed sequentially without padding for alignment purposes. When the driver attempts to interpret these raw bytes into native 16-bit integers using standard conversion functions like be16_to_cpup(), it relies on pointer arithmetic that calculates addresses based on offsets within a stack-allocated buffer. Specifically, the code computes pointers at buf and buf plus three bytes. Because the offset difference is odd, one of these resulting memory addresses will inevitably fall on an unaligned boundary relative to the architecture's word size requirements.
This architectural mismatch leads to severe operational instability on platforms that enforce strict memory alignment rules, such as ARMv5 and SPARC architectures. On these systems, accessing a 16-bit value from an address not divisible by two triggers a hardware exception known as an alignment fault. In the context of the Linux kernel, which operates in privileged mode with direct access to hardware resources, this unhandled exception results in a fatal kernel panic. Consequently, any system running affected kernels on strict-alignment architectures may experience immediate and complete service disruption when attempting to read sensor data from SHT3X devices. This represents a denial-of-service condition that can be triggered by normal operational activity rather than malicious exploitation, highlighting the importance of robust memory handling in low-level driver code.
The technical flaw is classified under CWE-120, which covers buffer copy without checking size limits, although more specifically it aligns with issues related to improper alignment or padding leading to undefined behavior and crashes. From a defense-in-depth perspective, this vulnerability also relates to CWE-479 regarding the use of a pointer in a return statement that does not point to an object defined by the current scope, as the function returns data derived from potentially unsafe memory access patterns. Furthermore, while primarily causing local denial-of-service through kernel panic, such instability can be leveraged in broader attack scenarios where system availability is targeted, mapping loosely to ATT&CK technique T1499 Endpoint Denial of Service if an attacker could induce repeated sensor polling on vulnerable hardware.
To mitigate this vulnerability and restore stability, the driver implementation must replace standard aligned access functions with their unaligned-safe counterparts. Specifically, be16_to_cpup should be replaced by get_unaligned_be16 for reading 16-bit big-endian values from arbitrary memory locations. Similarly, cpu_to_be16 used for writing data back to buffers should be substituted with put_unaligned_be16. These specialized functions handle the byte manipulation internally using shifts and masks rather than relying on direct pointer dereferencing that assumes alignment. This change ensures correct behavior across all architectures, including those requiring strict alignment, thereby preventing kernel panics and maintaining system availability during routine hardware monitoring operations.