CVE-2026-80695
Received Received - Intake

Unaligned Memory Access in Linux Kernel hwmon sht3x Driver

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (sht3x) Fix unaligned accesses Sashiko reports: In sht3x_update_client(), the 16-bit temperature and humidity values are extracted from a stack-allocated byte array using be16_to_cpup(). The pointers passed to this function are calculated as buf and buf + 3. Since the difference between the two pointers is an odd number of bytes, at least one of them is guaranteed to be at an unaligned offset. This will trigger an alignment fault on strict-alignment architectures such as ARMv5 or SPARC, resulting in a kernel panic. Fix the problem by using get_unaligned_be16() instead of be16_to_cpup(), and put_unaligned_be16() instead of cpu_to_be16().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-80695
EUVD
EUVD-2026-67430

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves unaligned memory access in the sht3x hardware monitoring driver. The issue occurs when extracting 16-bit temperature and humidity values from a byte array using be16_to_cpup(). The pointers used are at unaligned offsets, which can cause alignment faults on strict-alignment architectures like ARMv5 or SPARC, leading to kernel panics.

Detection Guidance

This vulnerability affects the Linux kernel's hwmon subsystem, specifically the sht3x driver. Detection requires checking the kernel version and verifying if the vulnerable code path is present. Use uname -a to check kernel version and grep for the affected driver in kernel logs or source code.

Impact Analysis

If you use a system with a strict-alignment architecture (e.g., ARMv5 or SPARC) and the affected Linux kernel driver (sht3x), this vulnerability could cause the system to crash with a kernel panic. This may result in data loss or service disruption.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a kernel-level hardware monitoring issue causing potential kernel panics on strict-alignment architectures. Compliance impact would only occur if system crashes led to data loss or unauthorized access, which is not specified here.

Mitigation Strategies

Apply the kernel patch that replaces be16_to_cpup() with get_unaligned_be16() and cpu_to_be16() with put_unaligned_be16() in the sht3x driver. Update to a fixed kernel version if available from your distribution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80695. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart