Exposure monitor
Vulnerabilities
Automotive Vulnerabilities. Hunted worldwide every 24 hours, across 🇺🇸🇨🇳🇯🇵🇰🇷🇹🇼🇩🇪🇫🇷🇨🇭🇦🇹🇳🇱🇧🇪🇵🇱🇨🇦🇱🇺🇪🇺. Stay ahead.
1962advisories found
nvdmedium
cve-2026-93074
A flaw in the Linux kernel's dax/fsdev direct_access code could return an incorrect kernel virtual address for multi-range devices with physical gaps, because it used linear offset arithmetic instead of translating each physical address independently. An attacker able to trigger this path could cause incorrect memory addressing, though the advisory does not state a severity rating. This could be relevant where the Linux kernel's dax/fsdev subsystem is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93072
A memory leak and potential use-after-free exist in the Linux kernel's Renesas IRQC interrupt chip driver, where generic interrupt chips are not freed when the driver is removed, and could later be accessed by suspend, resume, or shutdown callbacks, potentially causing a kernel crash. This could be relevant where this Renesas IRQC driver is deployed in automotive systems, since Renesas components are used in embedded and automotive platforms. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93073
A race condition in the Linux kernel's DAX subsystem allows a concurrent operation to clear a function pointer between a NULL check and its use, potentially causing a NULL pointer dereference and system crash. The vulnerability affects the dax_holder_notify_failure() function, which is part of the kernel's direct access storage support. This could be relevant where the Linux kernel's DAX subsystem is deployed in automotive systems, such as in embedded controllers or telematics units running Linux. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93071
The Linux kernel's bcm2835-unicam media driver fails to free a small memory allocation (the "asc") in its error and removal paths, causing a memory leak that was detected after the module was unloaded. An attacker able to repeatedly load and unload the driver could gradually exhaust kernel memory, though the advisory does not state a severity rating. This could be relevant where the bcm2835-unicam driver is deployed in automotive systems, since it is a camera interface driver for Raspberry Pi-class hardware sometimes used in embedded automotive setups. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93070
The Linux kernel's ipu6 media driver can double-free the isys/psys platform data during error handling after the auxiliary device has been initialized, because the bus release callback already frees that memory. An attacker able to trigger the affected error paths could cause memory corruption, though the advisory does not state a severity rating. This could be relevant where the Linux ipu6 media driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93068
A race condition in the Linux kernel's AMD display driver (amdgpu) can cause a NULL pointer dereference if a userspace I2C transfer runs while the display hardware is being torn down, crashing the kernel. The flaw is in the DM I2C adapter teardown path, and the advisory does not state a severity rating. This could be relevant where the amdgpu display driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93067
A flaw in the Linux kernel's tc358767 display bridge driver could let a malicious or malfunctioning DisplayPort device report an oversized AUX read, causing a buffer overrun of up to 256 bytes. The advisory describes this as defense in depth rather than a live exploitable hole, and the fix clamps the reported read size back to the requested size. This could be relevant where the tc358767 bridge is deployed in automotive display systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93065
The Linux kernel's iwlwifi Wi-Fi driver has a flaw where a loop counter is declared as an 8-bit value while the number of firmware program-counter entries is a 32-bit value, so if firmware reports more than 255 entries the counter wraps to zero and the loop may never terminate, potentially causing an infinite loop or reading past the allocated pc_data array. This could be relevant where the iwlwifi driver is deployed in automotive systems, since such systems may use Intel Wi-Fi hardware, though the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93064
The Linux kernel's iwlwifi mvm driver contains an off-by-one error in its TXF key sanitiser that leaves the final byte of a matched key unsanitised and zeroes one byte before the match. An attacker could potentially exploit this to leave sensitive key material exposed in memory. The advisory does not state a severity rating. This could be relevant where the iwlwifi driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93062
A flaw in the Linux kernel's iwlwifi wireless driver could allow a division-by-zero condition when allocating debug fragments, which may cause a crash or denial of service. This could be relevant where the iwlwifi driver is deployed in automotive systems, since such systems may use Linux-based wireless connectivity. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93058
A flaw in the Linux kernel's drm/msm graphics driver causes a partially initialized ring buffer to be torn down incorrectly when an allocation or scheduler setup step fails, because the cleanup path calls drm_sched_fini() even when drm_sched_init() did not complete successfully. An attacker able to trigger this failure path could cause improper teardown of scheduler work items, lists, and workqueue state, though the advisory does not state a specific severity rating. This could be relevant where the Linux kernel with the drm/msm driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93059
The Linux kernel's MSM DRM driver, used for Qualcomm Adreno GPU display and graphics support, has a reference leak in its GPU hang recovery worker where a task reference is not released on one code path. Repeated GPU hang recoveries could steadily leak kernel task references, potentially leading to resource exhaustion over time. This could be relevant where the MSM DRM driver is deployed in automotive systems, such as Qualcomm-based in-vehicle infotainment or cockpit platforms. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93057
A flaw in the Linux kernel's UFS storage driver could let a memory-reclaim deadlock occur during a specific link-training operation, potentially hanging the affected system. This could be relevant where the Linux UFS driver is deployed in automotive systems, since UFS storage is sometimes used in such platforms. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93055
A flaw in the Linux kernel's UDF filesystem handling could let an attacker trigger an out-of-bounds read by supplying a malformed symlink, potentially causing a crash or memory disclosure. The issue is resolved by validating that enough data remains before the pathComponent header is accessed. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93056
The Linux kernel USB gadget audio function f_uac1_legacy contained broken configfs string attributes whose store handler had an inverted null check, causing every write to fail with -ENOMEM on success and a NULL pointer dereference on allocation failure. The flaw was resolved by removing the affected attributes, and the advisory does not state a severity rating. This could be relevant where the Linux USB gadget audio function is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93052
A memory-ordering flaw in the Linux kernel's bcm-vk driver could let a reader observe the message queue as initialized while still seeing stale queue information, because the atomic operations used do not order those accesses. The fix uses release semantics when publishing the initialized queues and acquire semantics when checking the gate, closing the race. The advisory does not state a severity rating. This could be relevant where the bcm-vk driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93053
A flaw in the Linux kernel's speakup accessibility subsystem allows a local attacker with root privileges to trigger an out-of-range memory write by overriding function names through sysfs with a name that does not start with a lowercase letter. The affected component is the speakup keyhelp module, and the impact is an out-of-bounds write that could corrupt kernel memory. This could be relevant where the Linux kernel with the speakup subsystem is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93051
The Linux kernel's ad525x_dpot driver, which handles AD525x digital potentiometer chips, had a flaw where it manually created sysfs files during device probing and was responsible for cleaning them up, creating a risk of inconsistent state if probe or removal failed partway. An attacker able to trigger such a failure could potentially cause improper sysfs file handling, though the advisory does not state a specific severity rating. This could be relevant where the ad525x_dpot driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93049
A double-free vulnerability in the Linux kernel's mtdswap driver can occur when debugfs setup fails after a block translation device has already been registered, causing the same device structure to be freed twice. An attacker able to trigger this failure path could cause memory corruption or a system crash. The advisory does not state a severity rating. This could be relevant where the Linux kernel's MTD mtdswap subsystem is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93048
The Linux kernel's MTD partition handling has a flaw where a special offset value, MTDPART_OFS_RETAIN, is not rejected when a partition is added dynamically through the BLKPG ioctl on NAND devices, leading to undefined behavior. An attacker able to issue that ioctl could trigger a kernel warning and incorrect partition sizing, potentially causing a disabled empty partition or a bogus partition size rather than a clean error. The advisory does not state a severity rating. This could be relevant where the Linux MTD subsystem is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93046
The Linux kernel has a vulnerability in its software node component where a bounds check fails when an index value of UINT_MAX is passed to software_node_get_reference_args(), leading to an out-of-bounds access in the property array. An attacker able to trigger this condition could cause an out-of-bounds memory access, though the advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93047
A flaw in the Linux kernel's drm/v3d graphics driver meant that certain jobs could run without properly waiting for other work using the same memory buffers, potentially allowing one process to read data while another was still writing it and causing data corruption. This could be relevant where the v3d driver is deployed in automotive systems, for example in embedded or in-vehicle graphics components. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93042
The Linux kernel's dw-edma DMA engine driver mishandles transfer termination: when a stop is requested, it can still invoke a callback for the active descriptor and leave other descriptors queued, which can cause a use-after-free if client state has already been freed, or allow leftover transfers to restart into reused buffers or leak. The fix moves all issued and submitted descriptors to the terminated list and completes them without callbacks, and makes device_synchronize() wait for a pending stop before releasing resources. This could be relevant where the dw-edma driver is deployed in automotive systems, since it is a generic kernel DMA driver rather than an automotive-specific component. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93041
The Linux kernel's dw-edma DMA engine driver has a race condition where an abort interrupt handler releases its lock before updating request and status, allowing a concurrent operation to see stale busy state and skip starting queued descriptors, which are then permanently stranded when the abort handler marks the channel idle. An attacker able to trigger this timing window could cause denial of service through stalled DMA transfers. The advisory does not state a severity rating. This could be relevant where the dw-edma driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-93040
A race condition in the Linux kernel's dw-edma DMA engine driver allows the channel state to become inconsistent because pause and resume operations read and update state without holding the same lock used by interrupt handlers. An attacker or triggering condition could cause the channel to become permanently wedged, requiring no further interrupts to acknowledge a pause request and preventing recovery even after reconfiguration. The advisory does not state a severity rating. This could be relevant where the dw-edma driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.