Executive brief
The SHT3x hwmon (hardware monitoring) driver in the Linux kernel contains unaligned memory access bugs that can cause kernel panics on strict-alignment architectures like ARM and SPARC. The driver is used to read temperature and humidity sensor data; the bug occurs when extracting sensor values from buffers at misaligned memory addresses, leading to system crashes on affected hardware platforms.
Technical details
This is a memory alignment vulnerability in the SHT3x hwmon driver (drivers/hwmon/sht3x.c). The vulnerability exists in the sht3x_update_client() and limits_update() functions, which use be16_to_cpup() to read 16-bit big-endian values from stack-allocated byte arrays at offsets buf and buf+3. Since these offsets differ by an odd number of bytes, at least one pointer is guaranteed to be misaligned. On strict-alignment architectures (ARMv5, SPARC), this triggers an alignment fault and kernel panic. The fix replaces be16_to_cpup() with get_unaligned_be16() and cpu_to_be16() with put_unaligned_be16(), which safely handle unaligned accesses. No special preconditions are required—the bug manifests automatically during normal sensor data reading on vulnerable architectures.
Affected products
- Linux Linux kernel multiple versions across 2.6 through 7.x series
Timeline
- 2026-08-28: disclosed: Published via NVD
- 2026-07-25: patched: Upstream patch committed by Guenter Roeck
- 2026-08-09: patched: Patch backported to stable kernel series