Automotive Vulnerabilities. Hunted worldwide every 24 hours, across 🇺🇸🇨🇳🇯🇵🇰🇷🇹🇼🇩🇪🇫🇷🇨🇭🇦🇹🇳🇱🇧🇪🇵🇱🇨🇦🇱🇺🇪🇺. Stay ahead.
A race condition in the Linux kernel's Rust devres code could let two concurrent revocation paths interfere, potentially causing a use-after-free when one path frees memory the other still references. This could be relevant where the Linux kernel is deployed in automotive systems, since a use-after-free could lead to crashes or memory corruption. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's trusted key TPM backend has a teardown-ordering flaw where the TPM chip reference and digest array are freed before the trusted key type is unregistered, allowing a use-after-free that KASAN confirmed in tpm_pcr_extend. An attacker able to trigger the race could cause a freed digest array to be dereferenced or the TPM chip to be released while callbacks still use it, leading to memory corruption or a crash. This could be relevant where the Linux kernel trusted key TPM backend is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
The advisory describes a Linux kernel memory-management fix in mm/kmemleak that avoids a soft lockup when scanning task stacks, affecting systems running the relevant kernel code. An attacker able to trigger the condition could cause a soft lockup, a denial-of-service condition, though the advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
The advisory describes a fix in the Linux kernel's multi-generational LRU (mglru) memory management code that corrects and removes redundant handling of unevictable folios. The advisory does not state a specific attacker capability or a severity rating, so no technical impact or severity can be confirmed from the supplied text. This could be relevant where the Linux kernel is deployed in automotive systems, but the advisory does not confirm any automotive deployment; confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's memory migration code can stall an internal kernel grace-period mechanism for minutes when large batches of memory pages are unmapped, particularly on KVM virtualization hosts, because the loop's scheduling call does not report the required quiescent state on certain kernel configurations. An attacker able to trigger this condition could cause a denial of service through prolonged stalls in kernel tasks such as kcompactd, though the advisory does not state an explicit severity rating. This could be relevant where the Linux kernel is deployed in automotive systems, but the advisory does not confirm an automotive connection. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's memory migration code can cause a reference-count error when a page is moved out of the swap cache, potentially triggering a kernel crash. An attacker able to influence this memory-migration path could exploit the bug to cause a denial of service. The advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
The Linux kernel memory-reclaim function shrink_lruvec() could stall RCU-tasks processing because its scan loop only called cond_resched(), which does nothing on preemption kernels, so the reclaiming task never reported a quiescent state and became a holdout. The fix replaces that call with cond_resched_tasks_rcu_qs(), which reports a quiescent state even when cond_resched() does nothing. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
The Linux kernel memory cgroup limit-update path can, when two processes update the same memory.high or memory.max file concurrently, cause one writer to keep reclaiming memory toward a stale limit, and for memory.max it can loop indefinitely while repeatedly recording OOM events. This could be relevant where the Linux kernel is deployed in automotive systems, since a stuck kernel reclaim loop could degrade or hang the affected system. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's TDX (Trusted Domain Extensions) port I/O handling code contains an off-by-one error in its bit mask calculation, which makes the mask one bit wider than intended for all I/O sizes. An attacker could potentially exploit this flaw to cause incorrect data handling during port input/output operations in TDX-protected environments. The advisory does not state a severity rating. This could be relevant where the Linux kernel with TDX support is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
The Linux kernel tracing self-test can crash the kernel if an internal helper thread fails to start, for example under memory pressure during boot, because the code passes an invalid pointer to a thread-stop function that then dereferences it. The fix adds a check so the failure is handled safely and logged rather than causing a crash. This could be relevant where the Linux kernel tracing subsystem is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
The Linux kernel tracing subsystem's simple ring buffer reader swap has a bug where the retry counter is mishandled on the final attempt, causing a successful page replacement to be reported as an error and a failed replacement to be treated as successful. This can leave reader bookkeeping incomplete or corrupt the ring buffer, and the fix returns the documented -EBUSY error only when retries are truly exhausted. This could be relevant where the Linux kernel tracing subsystem is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
The Linux kernel tracing subsystem has a use-after-free vulnerability where changing the ring buffer sub-buffer size while a trace_pipe reader is active can cause the reader to access freed memory, potentially leading to a crash or memory corruption. This could be relevant where the Linux kernel tracing subsystem is deployed in automotive systems, such as in ECUs or telematics units running affected kernel versions. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's debugfs component means that when the kernel is in integrity (lockdown) mode, debugfs may not be properly locked down for files that use the newer mmap_prepare operation instead of mmap, weakening the intended security restriction. An attacker could potentially exploit this gap to bypass lockdown protections on affected systems, though the advisory does not state a specific severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's device property handling can cause an infinite loop when iterating over the children of a device node that has a secondary node with more than one child, repeatedly cycling through the same set of child nodes instead of terminating. An attacker able to trigger this condition could cause a denial of service through the resulting hang. The advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's NSM driver lets a malicious or buggy device backend report an oversized response length, causing the kernel to read beyond a fixed buffer and disclose adjacent kernel heap memory to user space. The advisory does not state that this component is used in vehicles or automotive systems; this could be relevant where the Linux NSM driver is deployed in automotive systems, and the severity is not explicitly rated in the advisory. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's V4L2 media subsystem is affected by a reverted error-handling fix in video device registration, where a failed device registration could previously lead to a double-free of the video_device structure. This could be relevant where the Linux kernel's V4L2 media subsystem is deployed in automotive systems, such as camera or video capture pipelines, though the advisory does not confirm any automotive deployment. The advisory does not state a severity rating. Confirm applicability through the product SBOM or dependency inventory.
The advisory describes a lifetime serialization issue in the Linux kernel's i.MX serial (UART) driver, affecting the imx_uart_ports[] structure. The stated impact is a potential race or use-after-free condition in that driver, though the advisory does not specify a severity rating or the exact attacker capability. This could be relevant where the i.MX UART driver is deployed in automotive or embedded systems, so confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's at91_udc USB gadget driver has a flaw in polled-VBUS mode where a self-restarting timer and work cycle is not cancelled when the driver is removed or probe fails, so a pending callback can access memory that has already been freed. This could let an attacker trigger a use-after-free, which may lead to a crash or potentially code execution, though the advisory does not state a specific severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
A use-after-free vulnerability exists in the Linux kernel's USB Type-C Thunderbolt alternate mode driver, where the removal function frees resources without first stopping a background work item that still references them. An attacker could potentially trigger this race condition to cause memory corruption or a system crash. The advisory does not state a severity rating. This could be relevant where the Linux kernel's USB Type-C Thunderbolt driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
The advisory describes a Linux kernel USB gadget MIDI2 fix that removes default configfs groups on teardown, affecting systems using that USB gadget function. The advisory does not state a specific attacker capability or severity, so no technical impact or severity rating can be confirmed from the supplied text. This could be relevant where the Linux USB gadget MIDI2 function is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's USB gadget UVC (USB video class) driver can cause a null pointer dereference when a worker thread fails to start, potentially crashing the affected system. This could be relevant where the Linux USB gadget UVC driver is deployed in automotive systems, such as embedded or in-vehicle devices that use this USB video functionality. The advisory does not state a severity rating. Confirm applicability through the product SBOM or dependency inventory.
The advisory describes a Linux kernel USB gadget function (f_fs) fix that prevents a deadlock during the endpoint zero read loop, affecting systems using that USB gadget driver. An attacker able to trigger the deadlock condition could cause a denial of service, though the advisory does not state a severity rating. This could be relevant where the Linux USB gadget subsystem is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's CXL RAS code causes an out-of-bounds read when copying AER error registers, because a software structure has grown larger than the physical register block it is read from, and this can trigger a second out-of-bounds read when error logs are printed. An attacker able to trigger this code path could cause the kernel to read beyond intended memory, potentially leading to a crash or unintended information exposure. The advisory does not state a severity rating. This could be relevant where the Linux kernel's CXL RAS support is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
The Linux kernel's Altera CVP FPGA driver has a vulnerability where a trailing-byte write path can read past the end of a valid input buffer, potentially causing a fault. An attacker able to supply a crafted FPGA configuration image could trigger this out-of-bounds read, though the advisory does not state a severity rating. This could be relevant where the Altera CVP FPGA driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
A flaw in the Linux kernel's KVM arm64 GICv2 interrupt handling lets a guest trigger a warning by writing an out-of-range interrupt ID, which can crash hosts configured to panic on warnings. This is a denial-of-service issue affecting the KVM virtualization component. This could be relevant where the Linux KVM arm64 hypervisor is deployed in automotive systems, for example in virtualized or embedded platforms. Confirm applicability through the product SBOM or dependency inventory.