Exposure monitor
Vulnerabilities
Automotive Vulnerabilities. Hunted worldwide every 24 hours, across 🇺🇸🇨🇳🇯🇵🇰🇷🇹🇼🇩🇪🇫🇷🇨🇭🇦🇹🇳🇱🇧🇪🇵🇱🇨🇦🇱🇺🇪🇺. Stay ahead.
1962advisories found
nvdmedium
cve-2026-93197
A flaw in the Linux kernel's memory cgroup handling means that when a cgroup is taken offline, its LRU page-accounting counters are copied to the parent rather than moved, leaving stale counters on the dying cgroup. This can cause the kernel's page-reclaim scanner to repeatedly scan empty lists, wasting CPU, and on one reported 251 GiB host the stale counters described roughly 476 GiB of pages that were on no list at all. The advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93198
A flaw in the Linux kernel's dm-pcache device-mapper target allows a crafted cache image, whose on-media fields are only protected by a crc32c checksum with a fixed seed, to point the persisted dirty_tail chain at a never-terminating sequence, causing the writeback worker to re-arm itself indefinitely. The fix validates the dirty_tail chain at load time and fails the table load with an EIO error if the chain does not terminate within the allowed number of hops. The advisory does not state a severity rating. This could be relevant where the Linux kernel and dm-pcache are deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93195
A flaw in the Linux kernel's Synopsys DisplayPort bridge driver means the DisplayPort AUX channel is registered when the driver starts but never unregistered, which can lead to resource leaks or use-after-free conditions. An attacker able to trigger this condition could potentially exploit the resulting memory error, though the advisory does not state a severity rating. This could be relevant where the Linux kernel with this DisplayPort driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93193
A reference leak was fixed in the Linux kernel's Rockchip analogix_dp display driver, where a device-tree node obtained during encoder enablement was not properly released. An attacker able to repeatedly trigger this code path could exhaust device-tree node references, potentially causing resource exhaustion or degraded system stability. The advisory does not state a severity rating. This could be relevant where the Rockchip analogix_dp driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93192
The Linux kernel's V3D graphics driver (used for Broadcom VideoCore GPUs) has a flaw where a failed fence creation leaves a dangling pointer to an active job in the queue. An attacker able to trigger this failure could cause the kernel to reference freed memory, potentially leading to a crash or other memory-corruption effects. The advisory does not state a severity rating. This could be relevant where the V3D driver is deployed in automotive systems, but the advisory does not confirm any automotive use. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93191
The Linux kernel's Smack mandatory access control module contains a flaw where a message-queue receive permission check is performed against the sending task instead of the intended receiving task, allowing a receiver that should not have access to obtain a message. This is a local privilege and policy-enforcement issue in the kernel's Smack security subsystem, and the advisory does not state a severity rating. This could be relevant where the Linux kernel with Smack is deployed in automotive systems, but the advisory does not confirm any automotive deployment; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93188
A flaw in the Linux kernel's HID driver for Roccat Kone USB devices allows a malicious USB device claiming that identity to supply an out-of-range profile index, causing the driver to read memory out of bounds and expose the result through a sysfs attribute. The advisory does not confirm automotive deployment; this could be relevant where Linux-based HID handling is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93187
A flaw in the Linux kernel's ASoC SOF audio driver causes widget setup to report success even when an invalid number of audio formats (zero) is supplied, so callers never learn the setup failed. An attacker or faulty configuration could trigger this condition, leading to improper error handling rather than a crash or data exposure, and the advisory does not assign a severity rating. This could be relevant where the Linux kernel's SOF audio subsystem is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93186
A flaw in the Linux kernel's CXL mailbox command handling lets a user supply an unbounded output size, causing a very large memory allocation that can trigger a kernel warning and panic on systems configured to panic on warnings. The advisory does not state any automotive connection; this could be relevant where the Linux kernel with CXL support is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93184
The Linux kernel's fsl_audmix audio driver could hang the system when register writes reach the AUDMIX hardware while it is still powered off between probe and first resume. The fix powers the hardware up and enables its clocks immediately after runtime PM is enabled, and also handles configurations where runtime PM is disabled. This could be relevant where the fsl_audmix driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93185
The advisory describes a Linux kernel fix in the ASoC rt700-sdw SoundWire codec driver, where the remove path only cancelled pending jack-detection work when a hardware state bit was set, potentially leaving a work item active after device removal. An attacker able to trigger this condition could cause a use-after-free or timer/work object lifecycle issue, though the advisory notes the practical trigger depends on SoundWire core remove ordering and may be a defensive cleanup rather than a reachable race on current systems. This could be relevant where the rt700-sdw codec driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93183
The Linux kernel's lima DRM driver can trigger a kernel bug during initialization because a memory allocator is set up with an invalid range before the correct address limits are assigned. An attacker able to trigger this code path could crash the affected system, though the advisory does not assign a formal severity rating. This could be relevant where the lima driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93181
A flaw in the Linux kernel's Intel uncore performance-monitoring code could leave a monitoring box uninitialized on systems with a single CPU per die, and could cause it to be torn down prematurely when CPUs go offline. An attacker able to trigger this condition could disrupt performance-monitoring behavior, though the advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93182
A divide-by-zero crash in the Linux kernel scheduler's fair scheduling code can be triggered by a 32-bit integer overflow in the update_tg_cfs_runnable function, which corrupts load-tracking values and can crash the system. This could be relevant where the Linux kernel is deployed in automotive systems, such as in ECUs, infotainment units, or telematics gateways, where an attacker able to trigger the specific scheduling workload could cause a denial of service. The advisory does not state a formal severity rating. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93180
The Linux kernel's panthor GPU driver has a flaw where partially unmapping an evicted buffer object can cause a NULL pointer dereference, crashing the kernel. An attacker able to trigger this operation could cause a denial of service on the affected system. The advisory does not state a formal severity rating. This could be relevant where the panthor driver is deployed in automotive systems, but the advisory does not confirm an automotive connection. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93179
The Linux kernel's AMD powerplay driver contains a flaw where a malformed VBIOS voltage table could cause an infinite loop or an out-of-bounds heap read. An attacker able to supply such a malformed table could trigger a hang or read unintended memory, though the advisory does not state a severity rating. This could be relevant where the AMD powerplay driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93178
A flaw in the Linux kernel's AMD GPU power management code (SMU7 voltage lookup) allows an out-of-range voltage index taken from VBIOS-parsed tables to be used without a bounds check, which the fix addresses by returning an error when an index is out of range. An attacker able to supply or influence such an index could trigger out-of-bounds access, though the advisory does not state a severity rating. This could be relevant where this AMD GPU kernel driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93177
A Linux kernel vulnerability in the AMD GPU power management driver (amdgpu) allowed out-of-range voltage indices from VBIOS-parsed tables to be used without bounds checks at nine locations, potentially causing invalid memory access. The fix returns an error when any index is out of range. This could be relevant where the amdgpu driver is deployed in automotive systems, though the advisory does not confirm any automotive use. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93175
A flaw in the Linux kernel's AMD display driver (drm/amd/display) could leave a dangling pointer in the CRTC reset function when a memory allocation fails, potentially allowing an attacker to access freed memory. This could be relevant where the AMD display driver is deployed in automotive systems, though the advisory does not confirm any automotive use. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93176
The Linux kernel's AMD display driver has a flaw where a plane reset function frees memory before allocating a replacement, and if that allocation fails, it leaves a pointer to freed memory. An attacker able to trigger this allocation failure could cause the system to use that dangling pointer, potentially leading to a crash or other memory-corruption effects, though the advisory does not state a severity rating. This could be relevant where the AMD display driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93174
A flaw in the Linux kernel's BPF subsystem could let an attacker read stale heap memory contents through per-CPU map lookups, because padding bytes in the map value were not being copied correctly. This is a kernel memory disclosure issue affecting the BPF component, and the advisory does not state a severity rating. This could be relevant where the Linux kernel's BPF subsystem is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93172
The Linux kernel has a memory-management flaw where a failed per-CPU memory allocation during hotplug node initialization is not checked, causing a NULL pointer dereference. An attacker able to trigger that allocation failure could crash or destabilize the affected system. The advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93173
The Linux kernel has a flaw where freeing a BPF program can trigger a sleepable LSM hook from an invalid context, causing a kernel BUG. An attacker able to trigger this path could crash or destabilize the affected system. The advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93171
A flaw in the Linux kernel's lp5860 LED driver could cause a mutex to be unlocked twice if device initialization fails, which may lead to unpredictable behavior. This could be relevant where the lp5860 driver is deployed in automotive systems, though the advisory does not confirm any automotive use. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93170
A race condition in the Linux kernel's Xilinx DMA driver (AXIDMA and MCDMA interrupt handlers) could cause a channel to be marked idle and start spurious transfers while descriptors are still being processed, potentially leading to descriptor corruption or missed completions. This could be relevant where this DMA driver is deployed in automotive systems, for example in embedded or SoC-based platforms. Confirm applicability through the product SBOM or dependency inventory.