Automotive Vulnerabilities. Hunted worldwide every 24 hours, across 🇺🇸🇨🇳🇯🇵🇰🇷🇹🇼🇩🇪🇫🇷🇨🇭🇦🇹🇳🇱🇧🇪🇵🇱🇨🇦🇱🇺🇪🇺. Stay ahead.
A flaw in the Linux kernel's CXL fwctl feature handling lets a request with a small input length but a large operation size cause the kernel to read beyond its allocated buffer, potentially sending out-of-bounds data to the device or crashing the kernel. This could be relevant where the Linux kernel's CXL subsystem is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel Bluetooth RFCOMM component has a use-after-free vulnerability in rfcomm_security_cfm() where a session and its DLCs can be freed concurrently while the callback is still traversing them, which KASAN confirmed as a slab-use-after-free. An attacker able to trigger this race could cause memory corruption or a crash of the affected system. This could be relevant where the Linux kernel Bluetooth RFCOMM stack is deployed in automotive systems, such as in infotainment or telematics units. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's IPv4 and IPv6 multicast forwarding can leave a packet linked to a socket that may already have been destroyed, so a later cleanup step can access stale memory. An attacker able to trigger this path could potentially crash the system or corrupt kernel memory, though the advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's IPv6 tunnel transmit path (ip6_tnl_xmit) could cause a use-after-free: on certain error paths the caller may free a network packet that the function had already consumed, potentially leading to memory corruption or a crash. The advisory does not confirm any automotive deployment; this could be relevant where the Linux kernel is deployed in automotive systems, and the stated impact is a use-after-free condition in the affected tunnel code. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel md/raid10 software RAID driver contains a bug where a boolean value was inverted during a code conversion, causing the driver to incorrectly clear bitmap bits needed for recovery. An attacker or normal operation could trigger silent data corruption: when a disk is re-added after a degraded period, the system may mark it as synchronized while it actually holds stale data, and the advisory reports this was reproduced with mismatched file contents. This could be relevant where the Linux kernel md/raid10 driver is deployed in automotive systems, but the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's libnvdimm label validation code allows a crafted namespace index value read from a DIMM label storage area, or supplied from userspace, to bypass a size check and cause an out-of-bounds write in kernel memory. An attacker able to supply such a value could corrupt memory beyond the intended buffer, though the advisory does not state a severity rating. This could be relevant where the Linux libnvdimm subsystem is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's MPLS networking code contains a use-after-free vulnerability in mpls_select_multipath(), where a cached header pointer can reference freed memory after pskb_may_pull() reallocates the packet buffer, potentially allowing an attacker to trigger a kernel crash or memory corruption. This could be relevant where the Linux kernel's MPLS stack is deployed in automotive systems, such as in-vehicle networking or gateway components. Confirm applicability through the product SBOM or dependency inventory.
A use-after-free race condition exists in the Linux kernel's nouveau graphics driver, specifically in the gem info ioctl, where the buffer object is not properly reserved around a vma lookup, allowing the gem close path to free the vma while it is still being accessed. An attacker able to trigger this race could potentially cause memory corruption or a system crash. The advisory does not state a severity rating. This could be relevant where the Linux kernel with the nouveau driver is deployed in automotive systems, though the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's SUNRPC code (the xdr_buf_trim function) can cause an unsigned integer underflow when trimming certain network data buffers, allowing a corrupted length value to be passed into downstream data decoders. An attacker able to trigger this condition could potentially cause memory corruption or other undefined behavior in affected systems. The advisory does not state a severity rating. This could be relevant where the Linux kernel's SUNRPC component is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's SUNRPC svcauth_gss code allows a remote attacker to send a malformed Kerberos token that passes the existing length check and reaches the krb5 unwrap path, where a truncated token can cause an out-of-bounds read or a divide-by-zero. The vulnerability is in the kernel's NFS/SUNRPC server authentication component, and the fix adds a minimum-length check to reject such tokens before they reach the unwrap core. This could be relevant where the Linux kernel's SUNRPC server is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
A use-after-free vulnerability in the Linux kernel's SUNRPC subsystem allows an attacker to trigger memory corruption when a cache_detail structure is freed while a cleanup routine may still hold a pointer to it. This could be relevant where the Linux kernel is deployed in automotive systems, such as in ECUs, infotainment units, or telematics gateways. Confirm applicability through the product SBOM or dependency inventory.
A use-after-free vulnerability in the Linux kernel's sunrpc component allows an attacker to potentially access freed memory when RCU readers traverse the thread list after a thread exits, which could lead to memory corruption or code execution. The flaw occurs because rq_argp and rq_resp buffers are freed immediately while the containing structure is freed later, leaving a window where those buffers can still be dereferenced. This could be relevant where the Linux kernel's sunrpc subsystem is deployed in automotive systems, for example in embedded infotainment or telematics units running Linux. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's SUNRPC subsystem contains a flaw in the gssx option-array decoder where error-handling paths can cause a NULL pointer dereference, a memory leak, and a use-after-free. An attacker able to trigger these error conditions could crash the system or corrupt memory, though the advisory does not state a specific severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
A use-after-free vulnerability in the Linux kernel's sunrpc subsystem can leave stale pointers after a pipefs mount or remount, potentially allowing an attacker to trigger memory corruption during subsequent RPC info operations. The advisory does not state a severity score. This could be relevant where the Linux kernel's sunrpc component is deployed in automotive systems, but the advisory does not confirm an automotive connection. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's SUNRPC subsystem contains a vulnerability in the gss_krb5_unwrap_v2 function, which fails to validate token length before reading header fields, potentially causing out-of-bounds reads, integer underflow, and a divide-by-zero error. An attacker could exploit this by supplying a malformed short token, leading to memory corruption or a system crash. This could be relevant where the Linux kernel's SUNRPC component is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's SUNRPC component lets a malicious krb5p NFS server send a crafted RPCSEC_GSS reply that bypasses length checks and causes the client to read memory out of bounds. This could be relevant where the Linux kernel's NFS client is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's SUNRPC Kerberos code allows a malicious NFS server or client to send a short authentication token that the kernel reads past the end of, potentially exposing memory or crashing the system. The issue affects the kernel's GSS/Kerberos MIC verification routine, and the advisory does not state a severity rating. This could be relevant where the Linux kernel's NFS or SUNRPC Kerberos functionality is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
The advisory describes a use-after-free vulnerability in the Linux kernel's svcrdma component, where a failed replacement listener allocation during an RDMA address-change event leaves a stale pointer that can be dereferenced during teardown. An attacker could potentially trigger this condition to cause a use-after-free, though the advisory does not state an assigned severity level. This could be relevant where the Linux kernel's svcrdma subsystem is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's svcrdma component, which handles remote direct memory access for network file services, involves incorrect offset arithmetic when processing read requests. An attacker could exploit this to cause incorrect memory lengths, potentially triggering a large memory allocation and a denial-of-service condition. The advisory does not state a severity rating and does not confirm automotive deployment; this could be relevant where the Linux kernel's svcrdma subsystem is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's svcrdma component lets a remote attacker send a specially crafted Write or Reply chunk with zero segments, causing an out-of-bounds memory read and a general protection fault when Send-With-Invalidate is negotiated. This could be relevant where the Linux kernel's svcrdma (RDMA server) code is deployed in automotive systems, though the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's svcrdma component, which handles RPC-over-RDMA replies such as NFS READ payloads, allowed a client to request a reply that overflowed a fixed-size buffer, causing memory corruption and out-of-bounds device reads. An attacker able to send such requests could corrupt adjacent kernel memory, though the advisory does not state a severity rating. This could be relevant where the Linux kernel's svcrdma server component is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's svcrdma component has a flaw where a remote requester can send multiple Read segments whose combined length exceeds the allocated page budget, causing a NULL pointer dereference during DMA mapping. An attacker able to send such requests could crash the affected system, representing a denial-of-service condition. This could be relevant where the Linux kernel's svcrdma is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's svcrdma component allows a remote client to supply a malformed RPC/RDMA Read chunk position that is not validated against the received inline body length, causing memory underflows. This can expose adjacent kernel slab memory to the upper XDR decoder or cause data to be copied past the receive buffer into request pages returned to the client. The advisory does not state a severity rating. This could be relevant where the Linux kernel's svcrdma component is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's UDF filesystem handling of virtual partition mapping (VAT) allows a crafted UDF image to pass a bounds check and cause the kernel to read one entry past the allocated VAT table, producing a slab-out-of-bounds condition and potential kernel panic. The issue is an off-by-one error in udf_get_pblock_virt15(), where the entry count was treated as an inclusive rather than exclusive upper bound. This could be relevant where the Linux UDF filesystem is deployed in automotive systems, such as infotainment or telematics units that mount removable media. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's mt7925 Wi-Fi driver has a flaw where a pending power-management work item can run after the device is reset, suspended, or unregistered, potentially accessing freed memory or sending commands to unavailable firmware. An attacker able to trigger this race could cause a crash or memory corruption, though the advisory does not state a severity rating. This could be relevant where the mt7925 Wi-Fi chipset is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.