Automotive Vulnerabilities. Hunted worldwide every 24 hours, across 🇺🇸🇨🇳🇯🇵🇰🇷🇹🇼🇩🇪🇫🇷🇨🇭🇦🇹🇳🇱🇧🇪🇵🇱🇨🇦🇱🇺🇪🇺. Stay ahead.
A race condition in the Linux kernel's Xilinx DMA driver (AXIDMA and MCDMA interrupt handlers) could cause a channel to be marked idle and start spurious transfers while descriptors are still being processed, potentially leading to descriptor corruption or missed completions. This could be relevant where this DMA driver is deployed in automotive systems, for example in embedded or SoC-based platforms. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's Xilinx DMA driver contained a flaw where a polling timeout with a zero delay could cause the CPU to busy-wait for several minutes instead of timing out as expected, potentially stalling the system. An attacker able to trigger this condition could cause a denial of service through prolonged CPU stalls. The advisory does not state a formal severity rating. This could be relevant where the Xilinx DMA driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A Linux kernel Wi-Fi driver issue in the rtw89 debug code involves an off-by-one comparison that could allow an out-of-bounds access. This could be relevant where the rtw89 driver is deployed in automotive systems, and the advisory does not state a severity rating. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's C-SKY syscall tracing code causes the fifth and sixth syscall arguments to be loaded from the wrong memory location, so traced syscalls that use those arguments, such as mmap2, can receive corrupted values and fail. The advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems on C-SKY processors; confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's Chrome sensorhub driver could let a malfunctioning embedded controller firmware cause the kernel to read past the end of a buffer, because the driver did not verify that the number of bytes returned matched the expected length. The advisory does not state a severity rating. This could be relevant where this Chrome platform sensorhub driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's optimized uprobes implementation on x86 processors could allow the call instruction used by uprobes to overwrite temporary data in the user stack's redzone, potentially corrupting user program state. The fix moves the optimized uprobe from a 5-byte to a 10-byte NOP and adds a stack-adjusting instruction to avoid the redzone, and also changes a syscall error code to -EPROTO so the fixed kernel can be detected. The advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems, for example in ECUs, infotainment units or telematics gateways that rely on uprobes for tracing or instrumentation. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's hardware random number generator (hwrng) registration code leaves a freed entry on an internal list when registration fails, which can lead to a use-after-free condition. An attacker able to trigger this failure path could potentially exploit the dangling reference to corrupt memory or crash the system, though the advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's QAT crypto driver can leave a work item pointing at stack memory after a timeout during SR-IOV re-enable, which could lead to memory corruption or a crash. An attacker able to trigger this timeout condition could potentially exploit the stale reference to cause a denial of service or other undefined behavior. The advisory does not state a severity rating. This could be relevant where the QAT driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's qat crypto driver leaves AES key material in stack memory because a temporary key schedule is not cleared after use. An attacker with the ability to read that memory could potentially recover the key material, though the advisory does not state a severity rating. This could be relevant where the qat driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's atmel-sha204a crypto driver, which handles a hardware random number generator over I2C, had a flaw where a failed I2C transfer left stale internal state that later reads could mistake for valid random data, potentially leaking heap information. An attacker able to trigger such a transfer failure could cause the driver to expose residual memory contents. The advisory does not state a severity rating. This could be relevant where the atmel-sha204a component is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's sa2ul cryptographic driver ignores a failure when creating the DMA pool used for security context buffers, so the driver can continue loading even though later operations depend on that pool. This could be relevant where the sa2ul driver is deployed in automotive systems, since a failed pool creation could leave the crypto subsystem in an inconsistent state, though the advisory does not state a specific attacker capability or severity rating. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's Xilinx TRNG hardware random number generator driver could return a misleading success result when its first data poll times out, causing callers to treat a failed read as a short successful read and potentially copy data from the wrong offset. This could be relevant where the Xilinx TRNG driver is deployed in automotive systems, though the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
A bug in the Linux kernel's Keem Bay crypto driver caused the wrong number of AEAD algorithms to be unregistered when a later registration step failed, which could leave the driver's internal state inconsistent. This is a correctness issue in an error-handling path rather than a directly exploitable flaw, and the advisory does not state a severity rating. This could be relevant where the Keem Bay crypto driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's Rockchip rk3288 crypto driver causes hash (ahash) requests to be finalized as successful even when the hardware hash engine fails to become idle within the expected timeout, because the driver ignores the result of its idle-status poll. An attacker able to trigger this condition could cause the driver to return a stale or incorrect digest instead of reporting an error, potentially undermining the integrity of cryptographic hash operations. The advisory does not state a severity rating. This could be relevant where the Rockchip rk3288 platform is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A use-after-free vulnerability in the Linux kernel's RDMA/irdma driver allowed a local user to deregister memory regions backing queue pair, completion queue, and send/receive queue rings, which could lead to memory corruption or a system crash. The fix adds reference counting so those memory regions cannot be freed while still in use. This could be relevant where the Linux kernel with the irdma RDMA driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's nvme-apple driver, which supports NVMe storage on Apple silicon systems, has a memory-ordering flaw where a queue could be marked enabled before its initialization was visible to interrupt and request paths. An attacker able to trigger this race could cause the system to use an uninitialized queue, potentially leading to a crash or memory corruption. The advisory does not state a severity rating. This could be relevant where this driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's RDMA/bng_re driver causes a firmware command wait to ignore its timeout, so if firmware responses stall the loop can repeat indefinitely instead of failing. An attacker or faulty firmware could trigger this to hang the affected system, though the advisory does not state a severity rating. This could be relevant where the Linux kernel RDMA/bng_re driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's NVMe-over-RDMA target (nvmet-rdma) can leak memory when a target is removed while I/O operations are still in flight, because a posted response's completion is never delivered and its allocated RDMA read/write context and request SGLs are never freed. An attacker or operator triggering this teardown scenario could cause a memory resource leak, which the advisory describes as a resource leak rather than a rated severity. This could be relevant where the Linux kernel's nvmet-rdma target is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A race condition in the Linux kernel's cgroup/cpuset subsystem can corrupt the nr_deadline_tasks counter when two code paths update it at the same time, which can lead to incorrect scheduling operations. The fix changes the counter to an atomic type so updates are always performed atomically, and the advisory describes this as a low-severity, low-hanging-fruit fix that addresses some but not all of the identified races. This could be relevant where the Linux kernel is deployed in automotive systems, but the advisory does not confirm any automotive deployment; confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's mac80211_hwsim Wi-Fi simulator driver has a race condition in its stop routine where a NULL packet can be passed to the transmit cleanup function, which the advisory states is resolved by changing the loop to use the dequeue result as its condition. This could be relevant where the Linux kernel's mac80211_hwsim component is deployed in automotive systems, though the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's BPF subsystem allowed certain memory accesses to read or write past the bounds of an allocated object when walking BTF structures with a trailing flexible array. An attacker able to load and run BPF programs could potentially exploit this out-of-bounds access, though the advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems, such as in ECUs, infotainment units, or telematics gateways. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel has a vulnerability in its s390 BPF implementation where the ly instruction fails to zero the upper bits of a 64-bit register when loading a 32-bit CPU number, potentially leaving stale data in the register. This could be relevant where the Linux kernel is deployed in automotive systems, though the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's time namespace code allows an attacker to supply an out-of-range nanosecond value that is not validated before use, potentially causing incorrect calculations or unexpected behavior. The affected component is the Linux kernel's time namespace handling, and the advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's Qualcomm GDSC clock driver means that when a power-domain provider is unregistered, its individual power domains are not properly removed, leaving stale entries behind. After a driver unbind and rebind, re-registration can fail with an "already exists" error, potentially disrupting power management for affected hardware. The advisory does not state a severity rating. This could be relevant where this Qualcomm clock/power-domain driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's ipu7 media driver has a power-management reference-count leak in its resume function, where a failed runtime resume leaves the device usage count incremented instead of releasing it. An attacker or faulty condition triggering this failure path could cause the reference count to remain unbalanced, potentially preventing the device from properly powering down. The advisory does not state a severity rating. This could be relevant where the ipu7 driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.