Exposure monitor
Vulnerabilities
Automotive Vulnerabilities. Hunted worldwide every 24 hours, across 🇺🇸🇨🇳🇯🇵🇰🇷🇹🇼🇩🇪🇫🇷🇨🇭🇦🇹🇳🇱🇧🇪🇵🇱🇨🇦🇱🇺🇪🇺. Stay ahead.
1962advisories found
nvdmedium
cve-2026-92491
A flaw in the Linux kernel's ARM SCMI firmware driver can leave partially registered protocol requests behind when a later entry in the same registration table fails, and because each request keeps a pointer to the driver's ID table, a failed module load can leave a dangling pointer after the module's memory is released. An attacker able to trigger this failure path could potentially exploit the dangling pointer, though the advisory does not state a severity rating. This could be relevant where the Linux kernel's ARM SCMI firmware interface is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-92490
The Linux kernel's ARM SCMI firmware interface has a flaw where, if driver registration fails, protocol device requests are left behind and can later cause the kernel to access freed memory. This could allow an attacker to crash the system or potentially execute code in kernel context, though the advisory does not state a severity rating. This could be relevant where the Linux kernel's ARM SCMI subsystem is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-92488
The Linux kernel's erdma RDMA driver could leak queue buffers, memory translation tables, doorbells and various identifiers when its destroy commands fail, because the affected functions returned early instead of completing cleanup. An attacker able to trigger a command timeout could permanently disable the command queue and make those resources unreachable, though the advisory does not state a severity rating. This could be relevant where the erdma driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-92487
The Linux kernel exfat filesystem has a race condition where extending valid_size over a shared writable mapping can cause data written through the mapping to be overwritten by zeroing of the page-cache gap. An attacker able to trigger this race could cause data corruption or loss within the affected file. The advisory does not state a severity rating. This could be relevant where the Linux exfat driver is deployed in automotive systems, such as infotainment or telematics units that mount exfat storage. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-92486
A flaw in the Linux kernel's BPF subsystem causes a control-flow integrity mismatch when a task work callback is invoked, which can trip the kernel's kCFI protection. An attacker able to trigger this condition could potentially cause a kernel crash or disruption, though the advisory does not state a severity rating. This could be relevant where the Linux kernel with BPF is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-92485
A flaw in the Linux kernel's BPF tracing subsystem can corrupt a trampoline structure when multiple fexit programs are attached to the same tail-call-reachable target, triggering a kernel warning during link release. An attacker able to load and manipulate BPF programs could potentially cause this corruption, though the advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-92484
The Linux kernel CXL region driver contains a use-after-free vulnerability in find_pos_and_ways() where an error path releases a reference to a switch decoder before logging an error message that accesses the decoder's name, potentially allowing the decoder to be freed before the name is read. An attacker able to trigger this error path could cause a use-after-free condition, which may lead to memory corruption or a system crash. The advisory does not state a severity rating. This could be relevant where the Linux kernel CXL subsystem is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-92483
A flaw in the Linux kernel's liveupdate subsystem means that when a file retrieval attempt fails, the kernel does not remember that failure, so a later attempt to retrieve another file tied to the same FLB can trigger a second retrieval on a component that may already be in an inconsistent state. This could lead to unpredictable behavior or further errors, though the advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-92481
The Linux kernel's MediaTek pinctrl driver fails to release EINT interrupt resources when the driver is unbound or removed as a module, leaving a dangling IRQ domain, stale interrupt mappings pointing at freed memory, and a chained handler that keeps firing into that freed data. An attacker able to trigger unbind or module removal could potentially cause use-after-free conditions or system instability, though the advisory does not state a severity rating. This could be relevant where the MediaTek pinctrl driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-92480
A flaw in the Linux kernel's UFS storage driver could let an attacker trigger an out-of-bounds read when the kernel processes string descriptors from a UFS device, potentially exposing memory beyond the intended buffer. This could be relevant where UFS storage is deployed in automotive systems, such as infotainment or telematics units. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-92479
A flaw in the Linux kernel's UFS storage driver can cause a NULL pointer dereference when the driver reports an invalid completion tag, potentially crashing the system. An attacker able to trigger this condition could cause a denial of service. The advisory does not state a severity rating. This could be relevant where the Linux UFS driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-92478
The Linux kernel's UFS (Universal Flash Storage) driver does not validate connected lane counts, allowing zero or out-of-range RX or TX lane counts to be used to index arrays sized by UFS_MAX_LANES. An attacker able to supply such values could trigger out-of-bounds array access in the TX equalization code, though the advisory does not state a severity rating. This could be relevant where the Linux kernel UFS driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-92477
A flaw in the Linux kernel's UFS (Universal Flash Storage) driver, in the debugfs error-writing function, allows a user-supplied input that exactly fills a stack buffer to overwrite its string terminator, which could lead to memory corruption. An attacker able to write to this debugfs interface could potentially exploit the missing terminator, though the advisory does not state a severity rating. This could be relevant where the Linux UFS driver is deployed in automotive systems, since UFS storage is sometimes used in embedded and vehicle platforms. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-92476
A Linux kernel cryptographic driver for Intel Keem Bay hardware, the keembay OCS AES driver, requests its interrupt before initializing a completion structure, so an interrupt arriving in that window could use an uninitialized completion. This is a race condition that could cause unpredictable behavior or a crash, though the advisory does not state a severity rating. This could be relevant where the Keem Bay crypto driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-90434
The Linux kernel's isofs filesystem driver has a memory leak in zisofs_fill_pages(), where the last buffer head reference is not released on the success path. An attacker could repeatedly trigger this code path to exhaust kernel memory, potentially causing a denial of service. The advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-90433
The Linux kernel's SPI "oc-tiny" controller driver has a memory-lifetime flaw: during device removal, the controller and its private data can be freed before the interrupt handler is drained, so a late or latched interrupt can access already-freed memory. An attacker able to trigger such an interrupt could cause a use-after-free, which the advisory treats as a vulnerability resolved by switching to managed allocation. This could be relevant where the oc-tiny SPI controller driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-90432
The Linux kernel's sched_ext scheduler has a vulnerability where a hard-lockup handler deferred its abort action to a queued work item that could never run on a CPU with interrupts disabled, so a hard-locked CPU could not recover. An attacker able to trigger this condition could cause a CPU to remain permanently stuck, and the fix makes the abort happen directly and corrects the return value so the kernel's hardlockup report is no longer wrongly suppressed. This could be relevant where the Linux kernel with sched_ext is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-90430
A race condition in the Linux kernel's tegra241-cmdqv IOMMU driver could let a latched LVCMDQ error, such as one inherited across a kexec, be handled before the command queue is fully initialized, causing a NULL pointer dereference and a crash. The fix publishes the queue only after it is fully built, using proper memory ordering so the error handler sees either a complete queue or NULL. This could be relevant where this NVIDIA Tegra IOMMU driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-90429
The Linux kernel's tegra241-cmdqv IOMMU driver has a race condition where its error interrupt handler can read a virtual interface slot while that slot is being cleared or freed, potentially causing a NULL pointer dereference or use-after-free. An attacker able to trigger concurrent error interrupts and interface teardown could crash the kernel or corrupt memory. The advisory does not state a severity rating. This could be relevant where this NVIDIA Tegra IOMMU driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-90428
A flaw in the Linux kernel's IOMMU driver for NVIDIA Tegra241 CMDQV hardware could let a latched error interrupt fire before the driver finishes initializing, causing the error handler to read an uninitialized array. This could lead to a crash or unpredictable behavior on affected systems. This could be relevant where this Tegra IOMMU component is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-90425
A flaw in the Linux kernel's tegra241-cmdqv IOMMU driver means that when a device has more than one Stream ID, only the first is mapped, so a guest's invalidation request cannot reach the other entries, and when a device has none, an out-of-bounds read occurs. An attacker could potentially exploit this to leave stale address-translation entries in place or trigger a memory access error, though the advisory does not state a severity rating. This could be relevant where this NVIDIA Tegra IOMMU driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-90426
The Linux kernel's tegra241-cmdqv IOMMU driver has a vulnerability where an error interrupt handler could access a freed or NULL pointer during device teardown, potentially causing a crash or memory corruption. This could be relevant where this NVIDIA Tegra IOMMU driver is deployed in automotive systems, though the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-90424
The Linux kernel's tegra241-cmdqv IOMMU driver has a memory leak on an error path during initialization, where a kernel-owned data structure (VINTF0) is not properly freed and cleanup routines run on fields that were never set up. An attacker able to trigger this initialization failure could cause a resource leak, though the advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-90422
A memory leak exists in the Linux kernel's MediaTek clock driver (pllfh), where an error path during PLL registration fails to release IO memory mapped on the fhctl node. An attacker able to repeatedly trigger this registration failure could exhaust kernel memory over time, though the advisory does not assign a specific severity score. This could be relevant where the Linux kernel with MediaTek clock drivers is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-90420
The Linux kernel's nilfs2 filesystem has a flaw where its cleaner ioctl can loop forever if the underlying device is remounted read-only after an I/O error, causing a hung task. An attacker able to trigger this condition could cause a denial of service by hanging the affected thread indefinitely. The advisory does not state a severity rating. This could be relevant where the Linux kernel with nilfs2 is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.