Exposure monitor
Vulnerabilities
Automotive Vulnerabilities. Hunted worldwide every 24 hours, across 🇺🇸🇨🇳🇯🇵🇰🇷🇹🇼🇩🇪🇫🇷🇨🇭🇦🇹🇳🇱🇧🇪🇵🇱🇨🇦🇱🇺🇪🇺. Stay ahead.
1962advisories found
nvdmedium
cve-2026-89648
A flaw in the Linux kernel's Ceph filesystem client lets a malicious or compromised Ceph MDS server send delegated-inode replies with attacker-controlled counts, causing the client to loop or grow memory without limit. The fix caps both the number of delegated inodes per session and the interval length accepted from a single reply, preventing the CPU and memory exhaustion. This could be relevant where the Ceph client is deployed in automotive systems, but the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89646
The Linux kernel's Ceph filesystem client has a flaw where an inode reference can leak when a writeback is aborted during unmount, leaving the inode unable to be freed and triggering a kernel bug. An attacker able to trigger this condition could cause a system crash or denial of service. The advisory does not state a severity rating. This could be relevant where the Linux kernel with the Ceph client is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89645
The advisory describes a flaw in the btrfs file system where recovered relocation root references are not properly dropped when recovery fails. This could be relevant where btrfs is deployed in automotive systems, as an attacker might exploit the incomplete recovery handling to cause a denial of service or system instability, though the advisory does not state a specific severity rating. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89643
A flaw in the Linux kernel's audit subsystem could let a use-after-free occur when fsnotify automatically removes certain audit rules, potentially causing a crash or memory corruption. This could be relevant where the Linux kernel is deployed in automotive systems, such as in ECUs, infotainment units or telematics gateways. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89644
A flaw in the Linux kernel's btrfs filesystem can leak an extent map reference during NOCOW direct I/O writes when an ordered extent allocation fails, which over time could exhaust memory and degrade or crash the affected system. This could be relevant where the Linux kernel with btrfs is deployed in automotive systems, such as in infotainment or telematics units. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89642
The advisory describes a change to the Linux kernel CIFS client that calls pagecache_isize_extended() in cifs_setsize() when extending a file, affecting systems using the CIFS network file system component. The advisory does not state a specific attacker capability or severity, so no technical impact or severity rating can be confirmed from the supplied text. This could be relevant where the Linux CIFS client is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89639
A flaw in the Linux kernel's CIFS network filesystem handling could allow stale cached data to be served after a file is truncated to zero, because the cache was not properly invalidated during truncation. An attacker or normal operation could potentially read outdated file contents that should no longer exist, though the advisory does not state a severity rating. This could be relevant where the Linux kernel's CIFS client is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89640
A flaw in the Linux kernel's CIFS file-sharing component could let an attacker trigger incorrect file-range operations when a clone request specifies an offset beyond the source file size, potentially causing data corruption or unexpected behavior. The advisory does not confirm automotive deployment; this could be relevant where the Linux kernel's CIFS client is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89638
A flaw in the Linux kernel's SMB/CIFS client means that when a file with the setuid or setgid bit set is written to, the bit is not cleared on the server for mounts using the cifsacl, modefromsid, or POSIX/Unix extensions options, unlike on local filesystems. An attacker could exploit this to retain elevated privileges when the file is later executed, potentially leading to privilege escalation. The advisory describes this as a security issue but does not assign a numeric severity score. This could be relevant where the Linux kernel's cifs.ko client is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89634
The Linux kernel SMB client has a flaw in how it handles error data when processing symbolic links, where a specially crafted length value can cause an integer overflow that bypasses a bounds check. An attacker able to supply such data could trigger an out-of-bounds read or an infinite loop, though the advisory does not state a severity rating. This could be relevant where the Linux kernel SMB client is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89632
A flaw in the Linux kernel's SMB client allows a malicious or compromised SMB server to trigger an out-of-bounds read by returning a response shorter than the fixed reparse header, causing the client to read past the end of received data. The advisory does not state a severity rating or confirm any automotive deployment. This could be relevant where the Linux kernel SMB client is deployed in automotive systems, such as in infotainment or telematics units that mount remote SMB shares. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89630
The Linux kernel SMB client has a flaw in its oplock break validation where a bounds check no longer rejects anything, because a prior code change left the comparison expression effectively zero. An attacker able to send crafted SMB traffic could exploit this to bypass the intended overflow protection, though the advisory does not state a severity rating. This could be relevant where the Linux kernel SMB client is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89629
A vulnerability in the Linux kernel's HID driver for Corsair Void devices could allow an out-of-bounds read when malformed status or firmware events are received, because the event size was not checked before reading. The advisory does not state a severity rating. This could be relevant where this driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89628
The advisory describes a Linux kernel fix in the HID picolcd driver that clamps the eeprom debugfs read to the number of bytes actually received, addressing a vulnerability in that driver. An attacker could potentially exploit the affected component, though the advisory does not state a specific severity rating. This could be relevant where the Linux kernel HID picolcd driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89626
A flaw in the Linux kernel's HID sensor custom driver means that if setting up one of a sensor's sysfs attribute groups fails partway through, the driver does not clean up the groups it already created, leaving stale state behind. An attacker able to trigger that failure path could cause the driver to free its field data while the enable_sensor interface still points into it, potentially leading to a use-after-free condition. The advisory does not state a severity rating. This could be relevant where the Linux kernel HID sensor subsystem is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89627
The advisory describes a Linux kernel fix in the HID roccat driver that frees buffered reports when a device is destroyed, addressing a memory handling issue in that driver. This could be relevant where the Linux kernel and HID subsystem are deployed in automotive systems, though the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89623
The advisory describes a Linux kernel fix in the HID mcp2221 driver that stops device I/O before calling hid_hw_stop, addressing a flaw in how the driver shuts down the device. The advisory does not state a severity rating, an attacker scenario, or any automotive connection, and the affected component is a USB-to-I2C/UART bridge chip that could be used in embedded or automotive-adjacent designs. This could be relevant where the mcp2221 HID driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89621
The Linux kernel HID driver for the MCP2221 USB-to-I2C/SMBus adapter fails to validate the size of incoming HID reports, so a malicious or misbehaving USB device can send a short report that causes the kernel to read past valid data and leak uninitialized kernel memory to userspace through the I2C/SMBus read path. The advisory does not state a severity rating. This could be relevant where the MCP2221 or similar USB-to-I2C bridge hardware is deployed in automotive systems, for example in diagnostics or embedded control setups. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89617
The Linux kernel's NTFS3 file-system driver does not properly validate a length field in its log-replay code, so a crafted NTFS volume can cause memory operations to run past the end of a buffer. An attacker able to supply such a malicious volume could trigger memory corruption, though the advisory does not state a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89618
The advisory describes a Linux kernel issue in the eventfs subsystem where the ei->children and ei->list fields are not initialized in init_ei(), which could allow an attacker to trigger undefined behavior or a system crash. The advisory does not state a severity rating or confirm any automotive deployment. This could be relevant where the Linux kernel is deployed in automotive systems, so confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89616
The Linux kernel's NTFS3 file-system driver contains a vulnerability in how it decompresses certain compressed files, where a crafted file can cause the system to return uninitialized kernel memory to userspace. An attacker able to supply such a file could read leftover kernel memory, potentially recovering kernel pointers and defeating a key security protection. The advisory does not state a severity rating. This could be relevant where the Linux kernel with the NTFS3 driver is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89614
A flaw in the Linux kernel's NTFS file-system driver lets a crafted disk image cause an out-of-bounds memory read when a file is extended, which the kernel's own memory checker reports as a slab out-of-bounds read. The issue is limited to the NTFS driver and conforming volumes are unaffected. This could be relevant where the Linux NTFS driver is deployed in automotive systems, for example in infotainment or telematics units that mount NTFS media. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89613
The Linux kernel's NTFS file system driver can mishandle a malformed NTFS attribute that has empty mapping pairs but inconsistent highest virtual cluster number and size values. An attacker able to supply a crafted NTFS image could trigger this flaw, though the advisory does not state a specific impact such as code execution or denial of service. This could be relevant where the Linux kernel is deployed in automotive systems, so confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89609
A flaw in the Linux kernel's ecryptfs component allows a race condition when a daemon shuts down, because queued messages are cleaned up without holding the required lock. An attacker able to trigger this race could cause memory corruption or instability in the affected kernel. This could be relevant where the Linux kernel is deployed in automotive systems, so confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-89608
A flaw in the Linux kernel's ecryptfs filesystem caused the parser to miscalculate the remaining buffer size when reading packet sets from file headers, potentially allowing an attacker to trigger an out-of-bounds read. This could be relevant where the Linux kernel with ecryptfs is deployed in automotive systems, such as in infotainment or telematics units. Confirm applicability through the product SBOM or dependency inventory.