Exposure monitor
Vulnerabilities
Automotive Vulnerabilities. Hunted worldwide every 24 hours, across 🇺🇸🇨🇳🇯🇵🇰🇷🇹🇼🇩🇪🇫🇷🇨🇭🇦🇹🇳🇱🇧🇪🇵🇱🇨🇦🇱🇺🇪🇺. Stay ahead.
1962advisories found
nvdhigh
cve-2026-89522
The Linux kernel's staging ipu7 media driver has a use-after-free flaw on its probe error path: if a later initialization step fails, the async notifier is never unregistered before the enclosing structure is freed, leaving a dangling entry in a global list. An attacker able to trigger this error path could cause list corruption or a use-after-free when the list is next walked, though the advisory does not state a severity rating. This could be relevant where the ipu7 camera/media driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89517
The Linux kernel scheduler component sched_ext contains a vulnerability where, under core scheduling on SMT systems, concurrent task selections can corrupt each other's state, causing a NULL pointer dereference or leaving a dequeued task running, which leads to hard system hangs. An attacker able to trigger specific scheduling workloads could crash or hang the affected system. The advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89513
A flaw in the Linux kernel's RISC-V KVM hypervisor code lets a malicious nested guest trigger an out-of-bounds read and write in the PMU event information handling by supplying a crafted event count that overflows a 32-bit size calculation. This could allow a guest to corrupt or read kernel memory, a serious memory-safety issue. This could be relevant where the Linux kernel's RISC-V KVM virtualization support is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89511
The Linux kernel qede network driver can crash with a NULL pointer dereference when processing TPA fragments under memory pressure, because a dropped assignment leaves a buffer data pointer uninitialized and a bad entry gets recycled into the receive ring, leading to a kernel panic. This could be relevant where the qede driver is deployed in automotive systems, since it is a generic Ethernet driver that may appear in embedded or vehicle networking platforms. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89510
The Linux kernel's RDMA cxgb4 driver has a flaw where removing the device can free memory while a pending registration task is still running, causing a use-after-free that could crash or corrupt the system. An attacker able to trigger this removal path could potentially exploit the freed memory, though the advisory does not state a severity rating. This could be relevant where the Linux kernel's cxgb4 RDMA driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89508
The Linux kernel's RDMA user-space connection management component has a use-after-free vulnerability in ucma_set_ib_path() where a missing lock allows a concurrent operation to reassign the context file, causing memory corruption and potentially wedging other threads. An attacker with local access and an RDMA device present could trigger a slab-use-after-free, as demonstrated by a KASAN report, though the advisory does not state a formal severity rating. This could be relevant where RDMA components are deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89507
A flaw in the Linux kernel's RDMA connection-management interface lets an unprivileged local user trigger memory corruption by racing a write operation against a context migration, potentially causing a kernel crash and leaving a lock permanently held. The affected component is the kernel's RDMA/ucma subsystem, which is generic infrastructure and not stated by the advisory to be used in automotive systems. This could be relevant where the Linux kernel's RDMA subsystem is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89495
The advisory describes a heap out-of-bounds write in the Linux kernel's ocfs2/o2dlm cluster filesystem code, where a node that has already joined a DLM domain can send a malformed DLM_MIGRATE_REQUEST message with an unchecked name length and corrupt memory on another node, potentially causing a panic. The advisory does not state that this component is used in vehicles, ECUs or automotive products, so this could be relevant where Linux with ocfs2/o2dlm is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89494
The Linux kernel's ocfs2 distributed lock manager does not validate length fields in incoming DLM_MIG_LOCKRES messages, so any node in the cluster domain can trigger an out-of-bounds read that ends in a kernel panic or a heap out-of-bounds write. This could be relevant where the Linux kernel's ocfs2 cluster filesystem is deployed in automotive systems, though the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89493
The advisory describes a flaw in the Linux kernel's ocfs2 filesystem where a crafted or corrupted refcount block can cause an out-of-bounds read and a large out-of-bounds memory move during reflink operations. An attacker with local administrative privileges who can mount a malicious ocfs2 image, or who can write directly to the underlying block device, could trigger this memory corruption. The advisory does not state a severity rating, but it notes the issue was reliably detected as a memory-safety violation under KASAN before the fix. This could be relevant where the Linux kernel with ocfs2 is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89489
The Linux kernel's OpenRISC architecture implementation contains a flaw in the or1k_atomic syscall, which swaps two memory words using user-supplied pointers without validating them. An unprivileged attacker could exploit this to read and write arbitrary kernel memory, potentially overwriting critical kernel data structures to gain code execution in kernel context. This could be relevant where the Linux kernel is deployed in automotive systems running on OpenRISC-based hardware. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89487
A flaw in the Linux kernel's Open vSwitch networking component could let an unprivileged attacker corrupt page-cache memory by stripping a packet flag during a failed userspace upcall, enabling an in-place decryption write over memory the sender does not own. This could be relevant where Open vSwitch is deployed in automotive systems, for example in vehicle back-end, telematics or in-vehicle virtualized networking stacks. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89488
The Linux kernel's Open vSwitch connection-tracking limit teardown contains a use-after-free flaw where packet processing can access freed state during network namespace teardown. An unprivileged local user can trigger this bug from a user and network namespace, causing a slab-use-after-free in ovs_ct_execute(). This could be relevant where Open vSwitch is deployed in automotive systems, such as in-vehicle networking or telematics gateways. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89486
A use-after-free vulnerability in the Linux kernel's IPMI subsystem allows an attacker to potentially access freed memory when a command receiver is destroyed while still in use, which could lead to memory corruption or a system crash. This could be relevant where the Linux kernel's IPMI subsystem is deployed in automotive systems, though the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89482
A flaw in the Linux kernel's NVMe-over-TCP driver lets a remote attacker trigger a wild-memory write by sending a crafted C2HData message for a WRITE_ZEROES command, which the driver mishandles because it checks the wrong length field. The advisory describes a kernel memory-corruption bug (reported by KASAN as a wild-memory-access) in the nvme-tcp receive path, with no severity rating stated. This could be relevant where the Linux nvme-tcp driver is deployed in automotive systems, but the advisory does not confirm any automotive deployment; confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89479
A use-after-free vulnerability in the Linux kernel's SCTP networking code allows a remote peer to send a crafted packet that frees an SCTP association and then continues processing the same packet against the freed memory, potentially causing a crash or memory corruption. This could be relevant where the Linux kernel's SCTP stack is deployed in automotive systems, such as telematics units or gateway ECUs that handle SCTP traffic. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89478
A use-after-free vulnerability in the Linux kernel's SCTP networking code could let an attacker who can send authenticated SCTP control messages remove a transport and cause the system to read freed memory, potentially leading to a crash or other memory-corruption effects. This could be relevant where the Linux kernel's SCTP stack is deployed in automotive systems, for example in telematics, gateway, or connectivity components. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89477
The Linux kernel SCTP networking stack contains a NULL pointer dereference vulnerability in stream reconfiguration handling that can crash the kernel. An unprivileged local process or a remote peer sending crafted SCTP packets can trigger the flaw, causing a kernel panic from softirq context. This could be relevant where the Linux kernel is deployed in automotive systems, such as in IVI units, telematics control modules, or gateway ECUs running SCTP-capable network stacks. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89475
The advisory describes a use-after-free vulnerability in the Linux kernel's bq24257 power supply driver, where a STAT-pin interrupt handler can reschedule work that then accesses memory already freed during device removal. An attacker able to trigger this race could cause the kernel to dereference freed memory, potentially leading to a crash or other memory-corruption effects, though the advisory does not state a severity rating. This could be relevant where the bq24257 battery charger driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89472
A use-after-free vulnerability exists in the Linux kernel's charger-manager power supply driver, where a race condition between a sysfs write and driver teardown can cause the kernel to access already-freed regulator handles. An attacker able to write to the charger's externally_control sysfs attribute during removal could trigger this, potentially leading to memory corruption or a system crash. The advisory does not state a severity rating. This could be relevant where the Linux charger-manager driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89471
A flaw in the Linux kernel's Chrome OS USBPD charger driver lets a malfunctioning, malicious or compromised embedded controller (EC) report an oversized port count that is not checked against the fixed 8-entry port array, causing an out-of-bounds write of up to about 1976 bytes. This could be relevant where this driver is deployed in automotive systems, though the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89470
A flaw in the Linux kernel's cros_usbpd-charger driver allows a malicious embedded controller to report an inaccurate USB PD port count, which can cause an out-of-bounds write and memory corruption. The issue is resolved by limiting port counts to EC_USB_PD_MAX_PORTS. This could be relevant where the cros_usbpd-charger driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89469
The Linux kernel's lp8727 power-supply driver contains a use-after-free flaw in lp8727_release_irq(), where an interrupt arriving during teardown can re-arm delayed work after the driver's memory has been freed, potentially allowing an attacker to trigger a crash or memory corruption. The advisory does not state a severity rating. This could be relevant where the lp8727 driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89467
The Linux kernel's qcom_battmgr power-supply driver contains a use-after-free flaw in which a PDR notification can keep queueing work that accesses battery-manager memory after it has been freed. An attacker able to trigger this condition could cause memory corruption or a crash, though the advisory does not state a severity rating. This could be relevant where the qcom_battmgr driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh
cve-2026-89465
The Linux kernel's rt9455 power-supply driver has a flaw where delayed work items can run after the driver's data structure has been freed, potentially causing a use-after-free that an attacker could exploit to crash or corrupt the system. This could be relevant where the rt9455 battery-charging component is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.