Exposure monitor
Vulnerabilities
Automotive Vulnerabilities. Hunted worldwide every 24 hours, across 🇺🇸🇨🇳🇯🇵🇰🇷🇹🇼🇩🇪🇫🇷🇨🇭🇦🇹🇳🇱🇧🇪🇵🇱🇨🇦🇱🇺🇪🇺. Stay ahead.
1962advisories found
nvdhigh
cve-2026-89641
A use-after-free vulnerability in the Linux kernel's CIFS file system could let an attacker crash the system or potentially execute code when a file-size operation fails and a network connection is being torn down or reconnected. The flaw is rated as a kernel memory-safety issue, though the advisory does not state a numeric severity score. This could be relevant where the Linux kernel's CIFS client is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89637
A use-after-free and buffer leak vulnerability exists in the Linux kernel's SMB client code, specifically in the cifs_check_trans2() function, which handles malformed secondary TRANSACT2 responses. An attacker able to send crafted SMB responses could cause the kernel to reuse freed memory, potentially leading to memory corruption or system instability. The advisory does not state a severity rating. This could be relevant where the Linux kernel SMB client is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89636
The Linux kernel SMB client contains a use-after-free vulnerability in which a cached target pointer is not cleared when its underlying structures are freed, leaving a dangling reference that could be used later. An attacker able to trigger this condition could potentially exploit the stale pointer to corrupt memory or crash the system, though the advisory does not state a specific severity rating. This could be relevant where the Linux kernel SMB client is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89635
The Linux kernel's ksmbd SMB server component contains a use-after-free vulnerability in its durable file handle reconnect logic, where reconnecting one session can incorrectly adopt another session's oplock and later dereference freed memory. An authenticated attacker could trigger a crash (KASAN slab-use-after-free) by manipulating durable handles and oplocks across two sessions on the same file. This could be relevant where the Linux kernel's ksmbd server is deployed in automotive systems, such as in-vehicle infotainment or telematics units exposing SMB file shares. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89633
A flaw in the Linux kernel's SMB client lets a malicious or compromised SMB server supply unvalidated offset values that can cause out-of-bounds heap reads and writes in the kernel. This could allow an attacker to corrupt memory or read data beyond intended buffer boundaries, and the advisory does not state a severity rating. This could be relevant where the Linux kernel SMB client is deployed in automotive systems, such as in infotainment or telematics units that mount remote SMB shares. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89631
The Linux kernel SMB client does not properly validate the byte count in a tree connect response, so a malicious or malformed server response with a byte count of 0 or 1 can cause an out-of-bounds read of up to roughly 65 KB past a kernel slab object, with the leaked bytes exposed to userspace through /proc/fs/cifs/DebugData. The fix rejects responses whose byte area is too small for the parser. The advisory does not state a severity rating. This could be relevant where the Linux kernel SMB client is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89625
The advisory describes a use-after-free flaw in the Linux kernel's HID driver for Sony game controllers, involving the ghl_poke_timer and ghl_urb objects when the driver is unbound. An attacker able to trigger this condition could potentially cause memory corruption or a system crash, though the advisory does not state a severity rating. This could be relevant where the affected Linux HID driver is deployed in automotive systems, so confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89624
A flaw in the Linux kernel's HID universal-pidff driver leaves a device running when force-feedback initialization fails, so a later open of the surviving hidraw device can write into freed memory, a use-after-free that KASAN confirms. An attacker able to open that device could trigger the write, which the advisory describes as a use-after-free write rather than assigning a numeric severity score. This could be relevant where the Linux HID subsystem is deployed in automotive systems, for example with force-feedback peripherals or embedded Linux controllers. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89622
The Linux kernel HID driver for the MCP2221 USB-to-I2C/SMBus bridge fails to clear a stored buffer pointer after an I2C/SMBus transfer completes or times out, leaving a dangling pointer that a delayed or spurious device report can write into freed memory, causing a use-after-free. An attacker able to trigger such a report could corrupt kernel memory, though the advisory does not state a severity rating. This could be relevant where the MCP2221 or this kernel driver is deployed in automotive or embedded systems; confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89620
A heap buffer overflow exists in the Linux kernel's Intel THC HID QuickSPI driver, where a report larger than the allocated buffer can be copied into it without a size check. An attacker able to send a crafted HID report through a hidraw SET_REPORT or SET_FEATURE ioctl could overflow the buffer with attacker-controlled length and content, which is a memory-corruption issue. This could be relevant where the Intel QuickSPI HID component is deployed in automotive systems, such as touch controllers; confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89619
A Linux kernel HID driver for Intel touch controllers (intel-thc-hid/intel-quickspi) fails to limit the size of a device-supplied GET_REPORT response to the caller's buffer, so a response larger than requested overflows that buffer with device-controlled data. An attacker able to control the touch controller's response could corrupt memory, though the advisory does not state a severity rating. This could be relevant where this Intel touch controller driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89615
A flaw in the Linux kernel's NTFS3 file system driver allows a crafted NTFS log record to overflow a fixed-size array (page_lcns[]) in an otherwise valid entry, because the record's run count was only checked against the record's own length and not the target entry. An attacker able to supply a malicious NTFS image or log record could trigger this out-of-bounds write, which the advisory addresses by adding bounds validation before the affected loops. This could be relevant where the Linux NTFS3 driver is deployed in automotive systems that mount NTFS volumes, but the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89612
The Linux kernel's NTFS file system driver does not properly validate the location of the Master File Table stored in a disk's boot sector, so a specially crafted NTFS volume can cause an out-of-bounds memory access when the volume is mounted. This could crash the system or potentially allow further exploitation, though the advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89611
The Linux kernel NTFS filesystem driver has a vulnerability where a maliciously crafted MFT record could cause memory corruption when converting between sparse and non-sparse attributes, because the code does not validate attribute name offsets or available space. An attacker able to supply a crafted NTFS image could trigger out-of-bounds writes or data corruption. The advisory does not state a severity rating. This could be relevant where the Linux NTFS driver is deployed in automotive systems that mount untrusted NTFS media. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89610
The Linux kernel's NTFS file-system driver fails to check that a data run stays within the volume boundary, so a malformed NTFS image could let an attacker trigger out-of-bounds memory access, potentially causing memory corruption and privilege escalation. This could be relevant where the Linux kernel's NTFS driver is deployed in automotive systems, such as head units or telematics devices that mount NTFS-formatted storage. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89607
The Linux kernel's eCryptfs filesystem fails to validate the size of an encrypted key field, allowing an attacker to trigger out-of-bounds memory writes that corrupt kernel data structures. This could be relevant where the Linux kernel is deployed in automotive systems, such as in infotainment head units, telematics control units, or gateway ECUs running Linux. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89603
A race condition in the Linux kernel allows an unprivileged process to bypass a newly installed seccomp filter, potentially executing a system call such as execve that the filter was meant to block. This could be relevant where the Linux kernel is deployed in automotive systems, since seccomp is a security control that may be relied upon in those environments. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89600
The Linux kernel's fanotify subsystem contains a use-after-free vulnerability in which a pointer to file range information stored on a triggering task's stack can be dereferenced after that stack frame is unwound, allowing a stale value to be copied to userspace. An attacker able to trigger this race could cause a kernel memory use-after-free, which KASAN confirmed, potentially leading to information disclosure or system instability. The advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89592
The Linux kernel's accel/rocket driver has a flaw in rocket_job_push() where a failed memory allocation is not checked before use, and user-supplied buffer counts can overflow, together allowing a kernel crash or out-of-bounds memory access. An attacker able to submit crafted requests to this driver could trigger a NULL pointer dereference or memory corruption, though the advisory does not state a severity rating. This could be relevant where the accel/rocket driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89587
A stack buffer overflow in the Linux kernel's ACPI pfr_update driver allows firmware returning oversized _DSM buffers to write past fixed 16-byte fields in a stack-allocated capability structure, potentially corrupting adjacent stack memory. This could be relevant where this ACPI component is deployed in automotive systems, though the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89583
A flaw in the Linux kernel's Bluetooth Extended Inquiry Response handling lets an attacker who controls Bluetooth advertising data trigger an out-of-bounds read, potentially exposing adjacent kernel memory to user space through a socket option. The issue affects the Bluetooth subsystem and is resolved by correcting the length calculation; the advisory does not state a severity rating. This could be relevant where the Linux Bluetooth stack is deployed in automotive systems, for example in infotainment or telematics units handling ISO broadcast audio. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89581
A flaw in the Linux kernel's BPF JIT compiler for x86 causes per-CPU address calculations to be written to the wrong CPU register when an extended register is used, which can lead to a kernel panic or memory corruption. An attacker able to run a crafted BPF program could trigger a fatal exception in interrupt context, potentially crashing the system. The advisory does not state a formal severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89580
A flaw in the Linux kernel's BPF subsystem allows a preemptible BPF program to be scheduled out while it holds a per-CPU perf callchain buffer, letting another task on the same CPU overwrite that buffer and inflate a length value, which can cause an out-of-bounds write in memory copy operations. The issue is resolved by disabling preemption around the buffer handling, and the advisory does not state an explicit severity rating. This could be relevant where the Linux kernel is deployed in automotive systems, so confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89579
The Linux kernel's BPF bloom filter map has two 32-bit-specific flaws: an integer overflow in the bitmap size calculation causes under-allocation, and signed bit indexing can produce out-of-bounds reads or writes. A local attacker with CAP_BPF on a 32-bit x86 kernel could exploit the under-allocation to write past the allocated object, enabling local privilege escalation. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89570
A flaw in the Linux kernel's CXL MCE notifier handling can cause NULL dereferences and use-after-free conditions in the MCE handler, which an attacker could potentially exploit to crash or destabilize the system. The issue affects the CXL memory error handling code, and the fix moves the notifier to be per-region rather than per memory device. This could be relevant where CXL memory components are deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.