Cloudanix VulnDB

CVE-2026-80695

None

CVSS

—

EPSS

0.2%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's code for reading certain temperature sensors can cause computers using specific processor types to crash during normal operation.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The sht3x hwmon driver performs 16-bit big-endian accesses on stack buffers using be16_to_cpup at offsets that are guaranteed to be misaligned (buf and buf+3), causing alignment faults and kernel panics on strict-alignment architectures such as ARMv5 and SPARC.

Why it matters to the business

Embedded or server systems that incorporate sht3x temperature/humidity sensors on affected CPU architectures can suffer unexpected kernel crashes during normal sensor polling, resulting in unplanned downtime and service interruption.

How an attack unfolds

Normal operation of the sht3x driver invokes sht3x_update_client which reads sensor data into a byte array and then extracts 16-bit values at unaligned addresses; on strict-alignment hardware this immediately raises an alignment exception that terminates the kernel.

How to fix it

Apply a kernel patch that replaces be16_to_cpup and cpu_to_be16 with get_unaligned_be16 and put_unaligned_be16 respectively inside the sht3x driver; rebuild and deploy the corrected kernel image.

How to confirm the fix worked

Inspect the sht3x driver source for the corrected unaligned accessors, boot the updated kernel on an ARMv5 or SPARC target while exercising sensor reads, and confirm absence of alignment faults in the panic log.

Typical attack path

  1. Invoke sensor update path that calls sht3x_update_client
  2. Perform be16_to_cpup on pointers separated by an odd byte offset
  3. Trigger alignment fault on strict-alignment CPU
  4. Kernel panic and system halt

How to detect it

Search kernel logs and crash dumps for alignment fault exceptions originating from the sht3x module during sensor update routines.

What your security team should do

  • Identify all Linux deployments that load the sht3x hwmon module on strict-alignment hardware
  • Prioritize kernel updates containing the unaligned-access fix
  • Add alignment-fault panic signatures to kernel crash monitoring

The record

In the Linux kernel, the following vulnerability has been resolved: hwmon: (sht3x) Fix unaligned accesses Sashiko reports: In sht3x_update_client(), the 16-bit temperature and humidity values are extracted from a stack-allocated byte array using be16_to_cpup(). The pointers passed to this function are calculated as buf and buf + 3. Since the difference between the two pointers is an odd number of bytes, at least one of them is guaranteed to be at an unaligned offset. This will trigger an alignment fault on strict-alignment architectures such as ARMv5 or SPARC, resulting in a kernel panic. Fix the problem by using get_unaligned_be16() instead of be16_to_cpup(), and put_unaligned_be16() instead of cpu_to_be16().

Affected packages

Ecosystem Package Introduced Fixed