Exposure monitor
Vulnerabilities
Automotive Vulnerabilities. Hunted worldwide every 24 hours, across 🇺🇸🇨🇳🇯🇵🇰🇷🇹🇼🇩🇪🇫🇷🇨🇭🇦🇹🇳🇱🇧🇪🇵🇱🇨🇦🇱🇺🇪🇺. Stay ahead.
1962advisories found
cvelistv5medium
cve-2026-80913
This advisory addresses a change in SELinux requiring every boolean value to be defined, which is a security configuration component. The technical impact is that undefined boolean values will no longer be accepted, potentially causing SELinux policy loading or enforcement to fail, which could weaken system security if not properly configured. This could be relevant where SELinux is deployed in automotive systems, as it is a generic Linux security module, but the advisory does not confirm any specific automotive impact. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80912
This advisory addresses a flaw in the SELinux subsystem of the Linux kernel where an unclaimed class value is not properly rejected in the security_get_classes() function. An attacker could potentially exploit this to cause unexpected behavior or a system crash, impacting system stability. This could be relevant where the Linux kernel with SELinux is deployed in automotive systems, such as in infotainment or control units; confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80911
The advisory addresses a fix in the Linux kernel's Sound Open Firmware (SOF) audio driver, specifically correcting an error path in the sof_widget_setup_unlocked() function. An attacker could potentially exploit the flawed error handling to cause a system malfunction or instability, though the advisory does not specify a severity rating. This could be relevant where the SOF audio component is deployed in automotive systems, such as in-vehicle infotainment, but the advisory does not confirm automotive use; confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80910
This advisory addresses a fix in the Linux kernel for the ASoC codec driver "lpass-wsa-macro," specifically correcting how enum kcontrol accesses are handled. An attacker could potentially exploit the improper access to cause a system crash or other undefined behavior, though the advisory does not state a specific severity rating. This could be relevant where the lpass-wsa-macro codec is deployed in automotive systems, as it is a component that might be used in audio processing for infotainment or similar applications; confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80909
The advisory addresses a vulnerability in the Linux kernel's amdgpu driver, specifically rejecting UVD messages with an invalid number of H.265 references. An attacker could potentially exploit this flaw to cause a denial of service or other undefined behavior in systems using affected AMD graphics hardware. This could be relevant where the amdgpu driver is deployed in automotive systems, such as for in-vehicle infotainment or graphics processing, but the advisory does not confirm automotive use; confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80908
This advisory addresses a vulnerability in the Linux kernel's amdgpu driver, which manages AMD graphics processing units. An attacker could exploit this flaw by sending a UVD (video decoding) message with dimensions exceeding 4096, potentially leading to a security issue. The severity is not explicitly stated in the advisory. This could be relevant where AMD GPUs are deployed in automotive systems for infotainment or driver assistance, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80907
The advisory describes a fix in the Linux kernel for the AMDGPU driver, specifically correcting the calculation of the minimum decoded picture buffer size for H.264 video in the UVD engine. An attacker could potentially exploit this flaw to cause incorrect memory allocation, which may lead to system instability or other technical impacts, though the advisory does not specify a severity rating. This could be relevant where AMDGPU hardware is deployed in automotive systems, such as for in-vehicle infotainment or display processing, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80906
The Linux kernel contains a vulnerability in its packet socket handling that can misidentify the transport header when sending VLAN-tagged frames, potentially leaving the header uninitialized. An attacker could exploit this to cause incorrect packet processing, which may lead to system instability or other unspecified impacts. This could be relevant where the Linux kernel is deployed in automotive systems, such as in infotainment or telematics units, but the advisory does not confirm vehicle use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80905
This advisory addresses a fix in the Linux kernel's network tap component for an issue where the transport header is incorrectly set when sending VLAN-tagged frames. An attacker could potentially exploit this flaw to cause incorrect network packet handling, though the advisory does not specify a severity rating or detailed attack impact. This could be relevant where the Linux kernel's tap networking is deployed in automotive systems, such as for in-vehicle communication or diagnostics, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80904
The advisory addresses a vulnerability in the Linux kernel's TLS implementation, specifically in the function tls_sw_splice_read(), where a failed asynchronous decryption is not properly handled. An attacker could potentially exploit this flaw to cause a denial of service or other unspecified impacts, with severity not explicitly stated in the provided text. This could be relevant where the Linux kernel's TLS networking component is deployed in automotive systems, such as in infotainment or telematics units, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80903
The advisory describes a memory leak in the Linux kernel's XE driver for Intel graphics, specifically in the Observation Architecture (OA) feature. An attacker could trigger a failure during configuration emission, causing the kernel to leak memory and fence references, which could lead to resource exhaustion over repeated attempts. The severity is not explicitly rated, but the fix addresses a denial-of-service style resource leak. This could be relevant where the XE driver is deployed in automotive systems using Intel graphics, though the advisory does not confirm automotive use; confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80902
The advisory addresses a fix in the Linux kernel's sun6i DMA engine driver related to reclaiming descriptors during DMA termination. An attacker could potentially exploit this flaw to cause improper handling of DMA operations, leading to system instability or denial of service. The severity is not explicitly stated in the advisory. This could be relevant where the sun6i DMA engine is deployed in automotive systems, such as in embedded controllers, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80901
The advisory describes a fix for checksum validations in the Linux kernel's IPVS component, which could be relevant where IPVS is deployed in automotive systems. The advisory does not state a specific attacker impact or severity. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80900
The advisory describes a fix in the Linux kernel for a vulnerability in the ASoC SDCA component, where an incorrect message size check could allow invalid sizes to pass if the message offset exceeds the buffer length. An attacker could potentially exploit this flaw to cause memory handling errors, though the advisory does not specify a severity rating or detail the exact technical impact. This could be relevant where the Linux kernel with SDCA support is deployed in automotive systems, such as for audio processing in infotainment units, but the advisory does not confirm any automotive use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80898
The advisory addresses a bug in the Linux kernel's netfs subsystem, where a failure to append data to a cache could leave a folio (a memory page) in an incorrect state, potentially causing resource leaks or instability. An attacker could potentially exploit this flaw to cause a denial-of-service condition, though the advisory does not specify a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems, such as in infotainment or telematics units, but the advisory does not confirm vehicle use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80896
The advisory describes a race condition fix in the Linux kernel's mshv component, which handles Microsoft Hyper-V virtual machine interrupt management. An attacker could potentially exploit the missing lock and improper list deletion to cause a double deletion on poisoned pointers, leading to memory corruption or system instability. This is a kernel-level vulnerability with no confirmed automotive deployment, but it could be relevant where Linux with mshv is used in automotive virtualization or embedded systems; confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80897
The advisory describes a bug in the Linux kernel's netfs subsystem where a failure during readahead preparation can leave memory references held, potentially causing resource leaks or instability. This is a kernel-level issue with no stated severity or direct attack impact, as it primarily concerns error handling in file I/O operations. The affected component is the generic Linux kernel, which could be relevant where it is deployed in automotive systems, such as in infotainment or control units. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80895
This advisory describes a race condition in the Linux kernel's Microsoft Hypervisor (mshv) driver, where a pointer to a virtual processor (VP) structure is published before its initialization is complete. An attacker could exploit this by registering an interrupt file descriptor for a VP that does not yet exist, then triggering an interrupt assertion concurrently with VP creation, potentially causing the kernel to use partially initialized data on weakly-ordered architectures. The severity is not explicitly stated, but the issue is a kernel memory-safety bug that could lead to unpredictable behavior. This could be relevant where the Linux kernel with the mshv driver is deployed in automotive systems, such as in virtualized or hypervisor-based infotainment or control platforms. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80894
This advisory describes a bug in the Linux kernel's iommufd component, which manages input/output memory management units for device access. The flaw causes the system to use the wrong hardware page table when automatically responding to device faults during a domain replacement operation, potentially leading to incorrect fault handling. The vulnerability is rated as a logic error in kernel code, and while iommufd is not exclusively automotive, it could be relevant where this kernel component is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80893
This advisory addresses a Linux kernel vulnerability in the mm/hugetlb subsystem, specifically a swap entry corruption issue that can occur when clearing userfaultfd write-protect (uffd-wp) flags during a fork() operation. An attacker could potentially exploit this flaw to corrupt memory or cause system instability, though the advisory does not specify a severity rating. This could be relevant where the Linux kernel is deployed in automotive systems, such as in infotainment or control units, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80891
This advisory addresses a vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for s390 (IBM mainframe) architecture, specifically involving PCI device handling where guest memory pages are pinned without proper validation of certain interrupt-related fields. An attacker could potentially exploit this flaw to cause a denial of service or other security impacts within virtualized environments. The severity is not explicitly stated in the advisory. This could be relevant where Linux KVM virtualization is deployed in automotive systems, such as for in-vehicle infotainment or telematics servers, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80892
The advisory addresses a Linux kernel vulnerability in the erofs filesystem, specifically capping the LZMA stream pool size to mitigate a potential issue. An attacker could exploit this flaw to cause a denial-of-service condition by exhausting memory resources through excessive LZMA stream allocations. The severity is not explicitly stated in the advisory, but the fix limits resource usage to prevent system instability. This could be relevant where erofs is deployed in automotive systems, such as for reading compressed filesystem images in embedded or infotainment contexts, though the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80890
This advisory addresses a vulnerability in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation, where stale cookies with mismatched verification tags are not properly rejected. An attacker could potentially exploit this flaw to cause incorrect SCTP connection state handling, which may lead to denial of service or other network-related impacts. The severity is not explicitly stated in the advisory. This could be relevant where Linux-based SCTP networking is deployed in automotive systems, such as in-vehicle infotainment or telematics units, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80889
This advisory describes a fix to the Linux kernel's CAN (Controller Area Network) ISOTP subsystem, addressing issues with timer drain order, wakeup handling, and transmission ordering. An attacker could potentially exploit these flaws to disrupt communication or cause instability in systems using this protocol. The severity is not explicitly stated in the advisory. This could be relevant where the Linux kernel's CAN ISOTP subsystem is deployed in automotive systems, such as for vehicle diagnostics or communication. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80888
The advisory addresses a vulnerability in the Linux kernel's vmwgfx driver, which handles graphics for VMware virtual machines, where a missing reference drop on a foreign file descriptor during prime import could lead to a use-after-free condition. An attacker could potentially exploit this to cause a denial of service or escalate privileges, though the advisory does not specify a severity rating. This could be relevant where the vmwgfx driver is deployed in automotive systems that use virtualized environments, but the advisory does not confirm automotive use; confirm applicability through the product SBOM or dependency inventory.