Exposure monitor
Vulnerabilities
Automotive Vulnerabilities. Hunted worldwide every 24 hours, across 🇺🇸🇨🇳🇯🇵🇰🇷🇹🇼🇩🇪🇫🇷🇨🇭🇦🇹🇳🇱🇧🇪🇵🇱🇨🇦🇱🇺🇪🇺. Stay ahead.
1962advisories found
cvelistv5medium
cve-2026-80887
The advisory describes a fix in the Linux kernel's vmwgfx DRM driver that uses check_add_overflow to properly bound shader size plus offset, addressing a potential integer overflow in that graphics driver component. An attacker could potentially exploit the flawed bounds check to cause memory corruption or other undefined behavior in affected systems. The advisory does not state a severity rating. This could be relevant where the vmwgfx driver is deployed in automotive systems, but the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80886
The advisory describes a race condition in the Linux kernel's serial driver for Qualcomm MSM devices, where concurrent writes from userspace and the kernel console can cause an infinite loop of repeated messages, most likely during system startup or shutdown. The fix disables DMA for the console UART to ensure a reliable output path. This could be relevant where this specific MSM serial driver is deployed in automotive systems, such as infotainment or telematics units, but the advisory does not confirm automotive use; confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80885
The advisory describes a fix in the Linux kernel for the AFS network filesystem, addressing an uncancelled out-of-band message handler that processes security challenges. An attacker could potentially exploit this flaw to cause improper handling of these messages, leading to system instability or a denial-of-service condition. This could be relevant where the Linux kernel with AFS is deployed in automotive systems, such as in infotainment or telematics units, but the advisory does not confirm automotive use; confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80883
This advisory addresses a Linux kernel vulnerability in the drm/tegra graphics driver, specifically involving the initialization of address register maps for the GR2D and GR3D engines before the HOST1X client is registered. An attacker could potentially exploit this issue to cause a system crash or other undefined behavior due to improper initialization. This could be relevant where the Tegra graphics driver is deployed in automotive systems, such as in infotainment or display units, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80881
The advisory describes a fix in the Linux kernel for the OCFS2 file system component. The vulnerability involves improper buffer head management that could allow corrupted metadata to be cached and passed to upper layers after a validation failure. An attacker could potentially exploit this to cause data inconsistency or system instability. This could be relevant where OCFS2 is deployed in automotive systems, such as for storage in embedded or server infrastructure, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80880
The Linux kernel contains a vulnerability in the mlx5 driver related to implicit On-Demand Paging memory registration, where a race condition could occur when rebuilding memory keys. An attacker could potentially exploit this to cause memory access issues or instability. The severity is not explicitly stated in the advisory. This could be relevant where the Linux kernel with the mlx5 driver is deployed in automotive systems, such as in infotainment or telematics units using compatible network hardware. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80879
The advisory describes a fix for a circular locking dependency in the Linux kernel's ocfs2 filesystem, which could cause a system deadlock during certain file operations like direct I/O writes and inode deletion. An attacker exploiting this could potentially trigger a denial-of-service by causing the system to hang. This is a kernel-level issue with no confirmed automotive deployment, but it could be relevant where the ocfs2 filesystem is used in automotive or embedded systems; confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80875
The advisory addresses a vulnerability in the Linux kernel's IPVS component, which is used for load balancing and is not confirmed to be automotive-specific. The issue involves incorrect TCP header parsing for IPv6 packets with extension headers, which could cause the system to misread packet data. This could be relevant where Linux-based IPVS is deployed in automotive systems, such as in vehicle networking or telematics infrastructure. Confirm applicability through the product SBOM or dependency inventory. The advisory does not state a severity rating.
cvelistv5medium
cve-2026-80874
The advisory describes a fix in the Linux kernel for Renesas "ironhide" hardware, where the DRAM controller uses inline ECC and requires specific memory areas to be reserved so the operating system does not access or corrupt them. If these areas are not properly reserved, an attacker or system instability could result from memory corruption, potentially making the system unstable. This could be relevant where Renesas ironhide hardware is deployed in automotive systems, but the advisory does not confirm such use; confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80873
The advisory describes a bug in the Linux kernel's KVM virtualization for ARM64 systems, where a nested SError exception injected into a guest hypervisor fails to update the ESR_EL2 register, leaving stale data that the guest could observe. An attacker exploiting this could potentially cause incorrect exception handling or information leakage within the virtualized environment. The severity is not explicitly rated in the advisory, but the fix is a code correction to ensure the register is properly written. This could be relevant where Linux KVM is deployed in automotive systems, such as for in-vehicle virtualization or infotainment platforms. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80872
The advisory addresses a Linux kernel issue in the ALSA hda/tas2781 audio driver, where an asynchronous firmware request is not properly canceled during device unbind, potentially leading to a use-after-free condition. An attacker could exploit this to cause memory corruption or a system crash, though the advisory does not specify a severity rating. This could be relevant where the tas2781 driver is deployed in automotive infotainment or audio systems, but the advisory does not confirm automotive use; confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80871
The advisory addresses a bug fix in the Linux kernel for the Xilinx TRNG (True Random Number Generator) driver, which is a hardware component that could be deployed in automotive systems. The fix removes an unused software interface and corrects two bugs: one where the driver sometimes reported success without generating all requested random bytes, and another where concurrent operations could interfere with each other, potentially leading to weak or incomplete random data. This could be relevant where the Xilinx TRNG is deployed in automotive systems, as weak random numbers could undermine security functions that rely on them; confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80870
The advisory addresses a vulnerability in the Linux kernel's AMD KFD driver, where user-supplied data during a checkpoint/restore process could include an invalid, oversized object ID. An attacker exploiting this could trigger a kernel warning, which may cause a system panic or reboot on systems configured to do so. The fix adds validation to reject such invalid IDs, preventing the warning. This could be relevant where the Linux kernel with the AMD KFD driver is deployed in automotive systems, such as for GPU-accelerated infotainment or advanced driver-assistance computing. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80869
The advisory describes a vulnerability in the Linux kernel's NTFS filesystem driver, where a crafted on-disk attribute list can cause an out-of-bounds memory read during the mounting of an NTFS volume. An attacker could exploit this by providing a malicious filesystem image, potentially leading to a system crash or information disclosure. This could be relevant where the Linux kernel is deployed in automotive systems that mount NTFS storage, such as infotainment or telematics units, but the advisory does not confirm such use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80868
The advisory addresses a bug in the Linux kernel's ntfs3 file system driver, where inline data was not guaranteed to be page-aligned, potentially causing a system crash (BUG) during write operations. The fix ensures this data is allocated on a full page to prevent the failure. This could be relevant where the Linux kernel with the ntfs3 driver is deployed in automotive systems, such as infotainment or telematics units, but the advisory does not confirm such use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80867
The advisory describes a fix in the Linux kernel for the Alpha architecture, where the pci_mmap_resource() function previously lacked a security check that is present in the generic version. This missing check could allow userspace programs to map PCI BARs (memory regions) even when the kernel is locked down, potentially enabling DMA attacks. The fix adds the security_locked_down() check to prevent this unauthorized access. This could be relevant where the Linux kernel is deployed in automotive systems, as PCI BAR access is a generic kernel feature, but the advisory does not confirm any specific automotive impact. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80866
The advisory describes a fix for a Linux kernel issue in the TIPC networking component, specifically preventing a busy loop during network namespace exit. An attacker could potentially exploit this flaw to cause a denial-of-service condition by disrupting system operations. This could be relevant where the Linux kernel with TIPC is deployed in automotive systems, such as in embedded or telematics platforms, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-80863
This advisory addresses an out-of-bounds (OOB) vulnerability in the RDMA/rxe component of the Linux kernel, specifically in the function free_rd_atomic_resources(). An attacker could exploit this flaw to cause memory corruption or a system crash, potentially leading to a denial of service. The severity is not explicitly stated in the advisory. This could be relevant where the RDMA/rxe component is deployed in automotive systems, such as in-vehicle networking or telematics, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-80862
The advisory describes a bug in the Linux kernel's nvme-tcp component, which manages data transfer for NVMe storage devices over TCP networks. The flaw causes incorrect memory refcounting and premature freeing of pages when block devices are created in parallel, potentially leading to a system crash or random panic. This could be relevant where nvme-tcp is deployed in automotive systems, such as for in-vehicle data storage or telematics, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-80861
The advisory describes a fix in the Linux kernel's USB xHCI driver that stops system setup if the controller is inaccessible, preventing a potential system hang or crash when the hardware is unavailable. The technical impact is a denial-of-service condition where an attacker could cause the system to become unresponsive. This could be relevant where the Linux kernel with the xHCI driver is deployed in automotive systems, such as infotainment or telematics units, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-80860
The advisory describes a race condition in the Linux kernel's FUSE subsystem, which handles filesystem communication between user space and the kernel. An attacker could potentially exploit this flaw to cause a system crash or denial of service by triggering inconsistent state during interrupt and resend operations. The vulnerability affects the Linux kernel generally, and while FUSE is not exclusively automotive, it could be relevant where Linux-based systems with FUSE are deployed in automotive infotainment or control units. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-80859
The advisory describes a fix for a missing memory barrier in the Linux kernel's FUSE filesystem component, which could cause a CPU to incorrectly skip a check that blocks request allocation until io-uring queues are ready, potentially reintroducing a lock-order inversion deadlock. This is a kernel-level concurrency bug, and the advisory does not confirm any specific automotive deployment. This could be relevant where the Linux kernel with FUSE is deployed in automotive systems, such as for in-vehicle infotainment or telematics, but the impact is a system stability issue rather than a direct safety or security breach. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-80858
The advisory describes a fix in the Linux kernel for the FUSE filesystem component, specifically addressing a memory-ordering flaw when publishing io-uring queues. An attacker could potentially exploit this race condition to access improperly initialized data, leading to system instability or a security breach. The severity is not explicitly rated in the advisory, but it is a kernel-level vulnerability requiring a patch. This could be relevant where the Linux kernel with FUSE is deployed in automotive systems, such as for in-vehicle infotainment or telematics; confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-80856
This advisory addresses a bug in the Linux kernel's fuse filesystem, specifically a lock leak that can occur when a writeback operation fails during a setattr call. An attacker could potentially exploit this flaw to cause a denial of service by exhausting system resources, though the advisory does not state a severity rating. This could be relevant where the Linux kernel with fuse is deployed in automotive systems, such as in infotainment or telematics units, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
nvdmedium
cve-2026-80854
This advisory addresses a vulnerability in the Linux kernel's USB gadget function driver for the TCM (Target Core Module), specifically in the f_tcm component. An attacker could potentially exploit a flaw where the port count is not maintained until LUN teardown completes, which could lead to system instability or unauthorized access through the USB interface. The severity is not explicitly stated in the advisory, but the issue affects the Linux kernel, which could be relevant where this USB gadget component is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.