CVE-2026-80695: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80695 Overview

CVE-2026-80695 is a Linux kernel vulnerability in the hwmonsht3x driver. The flaw causes unaligned memory accesses when the driver reads 16-bit temperature and humidity values from a stack-allocated byte buffer. In sht3x_update_client(), the driver passes buf and buf + 3 to be16_to_cpup(). Because the two pointers are separated by an odd number of bytes, at least one access lands on an unaligned offset. On strict-alignment architectures such as ARMv5 or SPARC, the misaligned load triggers an alignment fault and a kernel panic. The fix replaces be16_to_cpup() with get_unaligned_be16() and cpu_to_be16() with put_unaligned_be16().

Critical Impact
Local denial of service through a kernel panic on strict-alignment architectures whenever the sht3x humidity/temperature sensor driver is loaded and read.

Affected Products

Linux kernel hwmon subsystem, sht3x driver
Systems running the driver on strict-alignment architectures such as ARMv5 and SPARC
Distributions shipping affected stable kernel branches prior to the linked fix commits

Discovery Timeline

2026-08-28 - CVE-2026-80695 published to the National Vulnerability Database (NVD)
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80695

Vulnerability Analysis

The sht3x driver reads Sensirion SHT3x-series humidity and temperature values over I2C. The device returns two 16-bit big-endian values with an intervening CRC byte, so the raw payload is laid out at offsets 0, 1, 2 (temperature and CRC) and 3, 4, 5 (humidity and CRC). The driver then dereferences those bytes as if they were aligned 16-bit words. The compiler is entitled to assume that be16_to_cpup() receives a properly aligned pointer, because __be16 is a fully-aligned type. On architectures where the CPU issues a load-halfword instruction that faults on odd addresses, this assumption breaks and the kernel oopses. Denial of service is the practical impact; there is no memory corruption or privilege boundary crossed.

Root Cause

The root cause is improper handling of packed byte streams as aligned integers. Using be16_to_cpup() on buf + 3 is undefined behavior with respect to alignment requirements. This class of defect maps to unaligned memory access handling within a kernel driver.

Attack Vector

Triggering the fault requires a system that loads the sht3x driver against a real or emulated SHT3x sensor on a strict-alignment architecture. Any process that reads the exposed hwmon sysfs attributes causes the driver to execute sht3x_update_client() and hit the fault. The result is a kernel panic and system outage.

No verified public exploit code is available. See the upstream fix in Kernel Git Commit #1fb4165 for the exact source-level change.

Detection Methods for CVE-2026-80695

Indicators of Compromise

Kernel panic messages referencing an alignment fault inside sht3x_update_client on ARMv5, SPARC, or similarly strict-alignment platforms.
Repeated hwmon sysfs read failures followed by unexpected reboots on affected embedded systems.

Detection Strategies

Inventory kernels built with CONFIG_SENSORS_SHT3x enabled and cross-reference against the fixed commits listed in the advisory references.
Compare running kernel versions to the patched stable branches identified by the four upstream commits in the advisory.
Review crash dumps and dmesg archives for alignment traps originating in the hwmon subsystem.

Monitoring Recommendations

Forward kernel logs from embedded and IoT fleets to a central log store and alert on Alignment trap, Unable to handle kernel, or sht3x strings.
Track unplanned reboots on ARMv5 or SPARC hosts and correlate with hwmon driver activity.

How to Mitigate CVE-2026-80695

Immediate Actions Required

Update to a Linux stable release that includes the fix from Kernel Git Commit #c498adf or one of the sibling backports.
On systems that cannot be patched immediately, unload the sht3x module and blacklist it until the fix is deployed.
Prioritize patching on ARMv5, SPARC, and any other strict-alignment platforms that expose the driver.

Patch Information

The upstream fix replaces be16_to_cpup() with get_unaligned_be16() and cpu_to_be16() with put_unaligned_be16() inside the sht3x driver. Backports are available in the following commits: Kernel Git Commit #1fb4165, Kernel Git Commit #81529ad, Kernel Git Commit #c498adf, and Kernel Git Commit #f46d5ab.

Workarounds

Blacklist the sht3x kernel module on affected strict-alignment hosts until the patched kernel is installed.
Restrict read access to /sys/class/hwmon/hwmon*/ on unpatched systems to reduce the chance of accidental panics from monitoring agents.

bash

# Prevent the vulnerable driver from loading until the kernel is patched
echo "blacklist sht3x" | sudo tee /etc/modprobe.d/blacklist-sht3x.conf
sudo rmmod sht3x 2>/dev/null || true
sudo update-initramfs -u