Automotive Vulnerabilities. Hunted worldwide every 24 hours, across 🇺🇸🇨🇳🇯🇵🇰🇷🇹🇼🇩🇪🇫🇷🇨🇭🇦🇹🇳🇱🇧🇪🇵🇱🇨🇦🇱🇺🇪🇺. Stay ahead.
A use-after-free vulnerability in the Linux kernel's RDMA core (ib_core) module could allow an attacker to trigger memory corruption when the module is unloaded while queued RCU callbacks are still pending. This could be relevant where the Linux kernel RDMA subsystem is deployed in automotive systems, though the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's BPF tracing subsystem means that attaching a tracing_multi link and then an fentry link can fail to release the tracing_multi link, triggering a kernel warning in the trampoline code. The fix marks tracing_multi trampolines as ftrace managed so the link is released correctly. The advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems, so confirm applicability through the product SBOM or dependency inventory.
A use-after-free vulnerability in the Linux kernel's RDMA/mlx5 driver allows a queued callback to run after the driver module has been unloaded, which can cause memory corruption or a crash. This could be relevant where the Linux kernel's mlx5 RDMA driver is deployed in automotive systems, though the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's RDMA/ipoib component allows a race during module teardown where the driver can be unloaded while an RCU callback is still executing, potentially causing a use-after-free condition. An attacker able to trigger this teardown sequence could crash the system or corrupt kernel memory, though the advisory does not state a specific severity rating. This could be relevant where the Linux kernel with RDMA/ipoib is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's RDMA/hfi1 driver can, when a device allocation step fails, cause cleanup code to mistakenly remove an unrelated device from the driver's device table. This could lead to incorrect device handling or disruption of another device on the same system. The advisory does not state a severity rating. This could be relevant where the Linux kernel's hfi1 RDMA driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's v4l2-async media subsystem can cause a crash when a USB video capture device using the tvp5150 i2c driver is disconnected, because the sub-device is not properly unregistered when its async list is empty. An attacker or user could trigger this crash through device disconnect, resulting in a denial-of-service condition. The advisory does not state a formal severity rating. This could be relevant where the Linux kernel media subsystem is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's RDMA hfi1 driver fails to free RX data when device initialization fails late in the probe process, causing a memory leak of the netdev_rx structure and its dummy network device. An attacker or faulty condition that triggers this late probe failure could cause resource exhaustion through repeated leaks, though the advisory does not state a severity rating. This could be relevant where the Linux kernel hfi1 driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel rpmsg GLINK endpoint teardown can deadlock during driver detach, causing module removal to hang indefinitely. This could be relevant where Qualcomm GLINK rpmsg is deployed in automotive systems, since a hang during driver detach could affect availability of the affected subsystem. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's CXL mailbox poison-list handling lets a malfunctioning or malicious device that repeatedly returns an empty payload with the "more" flag set cause an infinite loop while holding a lock, hanging the poison scan thread and blocking later poison operations on that device. The advisory does not state a severity rating. This could be relevant where the CXL subsystem is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
A race condition in the Linux kernel's CXL feature-transfer code allows two concurrent multi-part Get or Set Feature operations to interleave and corrupt the device's transfer context. The flaw is reachable from fwctl and EDAC scrub, ECS, and repair paths, and is fixed by adding a per-mailbox mutex held across the entire transfer. The advisory does not state a severity rating. This could be relevant where the Linux CXL subsystem is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's ARM SCMI firmware driver could let a pending or spurious callback fire before the transport channel state is fully set up, causing a NULL pointer dereference and a crash. The issue affects the mailbox and SMC transport setup paths, and the advisory does not state a severity rating. This could be relevant where the Linux ARM SCMI driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A use-after-free race condition exists in the Linux kernel's ARM SCMI firmware driver, where a device notifier could access protocol data structures after they have been destroyed during driver removal. An attacker able to trigger this race could potentially cause a crash or memory corruption in the kernel. The advisory does not state a severity rating. This could be relevant where the Linux kernel ARM SCMI driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's ARM SCMI firmware driver can leak transport channels, transport devices and IDR state when channel setup fails partway through, because the error path skips the existing cleanup routine. This is a resource-cleanup bug rather than an attacker-exploitable flaw, and the advisory states no severity rating. This could be relevant where the Linux kernel ARM SCMI driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's ARM SCMI firmware driver can leave transport resources such as interrupts, mailbox channels and mapped shared memory unreleased when a channel setup step fails partway through. An attacker or faulty condition triggering this error path could cause resource leaks that degrade or destabilize the affected system. The advisory does not state a severity rating. This could be relevant where the Linux ARM SCMI driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's ARM SCMI firmware driver has a flaw in how it cleans up communication channels, where removing entries during iteration can corrupt the iterator state and lead to unsafe behavior. An attacker able to trigger this cleanup path could potentially cause a crash or memory corruption, though the advisory does not assign a specific severity rating. This could be relevant where the Linux kernel ARM SCMI driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's ARM SCMI firmware driver allowed a malformed device-tree protocol ID value to be processed instead of rejected, which could cause the value to be truncated or treated as a different protocol. An attacker able to supply such a malformed value could potentially disrupt or misconfigure SCMI protocol handling. The advisory does not state a severity rating. This could be relevant where the ARM SCMI driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's ARM SCMI firmware interface has a flaw where a failed protocol driver bind can leak a reference to the SCMI instance and leave a stale handle in place. An attacker could potentially exploit this to cause a concurrent parent unbind to tear down the SCMI instance while a child still holds a handle, leading to a use-after-free or system instability. The advisory does not state a severity rating. This could be relevant where the ARM SCMI firmware interface is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's ARM SCMI firmware driver can leave a mailbox channel allocated when a secondary channel setup fails, potentially keeping that channel busy for later attempts. This could be relevant where the Linux kernel ARM SCMI driver is deployed in automotive systems, since SCMI is used for communication between processors in some embedded platforms. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's ARM SCMI firmware driver can leak an allocated mailbox channel when setting up a P2A receiver channel fails, potentially leaving the channel busy for later probe attempts. An attacker or faulty condition that triggers this setup failure could cause the affected system to be unable to properly initialize the SCMI mailbox interface. The advisory does not state a severity rating. This could be relevant where the ARM SCMI driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's ARM SCMI firmware interface has a flaw where a device reference is released too early, allowing a concurrent unregister to free a device while the destroy path is still using it, and also allowing a new SCMI device to reuse an ID while the old device is still registered. An attacker able to trigger this race could cause use-after-free or device-ID reuse issues, though the advisory does not state a severity rating. This could be relevant where the Linux ARM SCMI subsystem is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's ARM SCMI firmware transport layer had a teardown flaw where duplicate protocol channel definitions from malformed firmware could cause an existing transport device to be destroyed when a duplicate insertion failed. An attacker able to supply malformed firmware could trigger this device teardown, potentially disrupting SCMI-based communication. This could be relevant where the Linux ARM SCMI subsystem is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's CXL feature handling lets a request with a zero-length output buffer pass an unchecked size test, causing a write through an invalid pointer that can crash or corrupt the system. The issue is resolved by rejecting requests whose output buffer cannot hold the response header. This could be relevant where the Linux CXL subsystem is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's CXL (Compute Express Link) feature handling could let a device that returns more data than requested overflow a buffer during a Get Feature operation. This could be relevant where the Linux kernel's CXL subsystem is deployed in automotive systems, though the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's DAX/fsdev code leaves a stale vmemmap_shift value on a shared static pgmap when a device is rebound from device_dax to fsdev_dax, causing the vmemmap to be built incorrectly instead of for order-0 folios as fsdev requires. An attacker able to trigger this rebinding could cause memory-mapping errors or system instability, though the advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's dax/fsdev subsystem leaves stale function pointers and owner references on a shared page-map structure after a static device is unbound, which can cause a subsequent memory failure to be dispatched through a stale or freed handler. An attacker able to trigger that memory-failure path could potentially cause a crash or other memory-corruption impact, though the advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.