Exposure monitor
Vulnerabilities
Automotive Vulnerabilities. Hunted worldwide every 24 hours, across 🇺🇸🇨🇳🇯🇵🇰🇷🇹🇼🇩🇪🇫🇷🇨🇭🇦🇹🇳🇱🇧🇪🇵🇱🇨🇦🇱🇺🇪🇺. Stay ahead.
1962advisories found
cvelistv5medium
cve-2026-80538
The advisory addresses a vulnerability in the Linux kernel's XFS filesystem, specifically in the function that loads realtime group inodes. An attacker could exploit an I/O, allocation, or corruption error to cause the system to incorrectly treat the inode as successfully loaded, allowing growfs operations to continue with an unset inode, potentially leading to data corruption or system instability. The severity is not explicitly rated in the advisory, but the flaw involves error handling in a core filesystem component. This could be relevant where the Linux kernel with XFS is deployed in automotive systems, such as in-vehicle infotainment or telematics units, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80539
The advisory describes a vulnerability in the Linux kernel's amdgpu driver, which is used for AMD graphics processing units. An attacker could submit a graphics command with multiple fence chunks, causing a memory leak that persists beyond process exit, potentially leading to system resource exhaustion. This could be relevant where AMD GPUs are deployed in automotive systems for infotainment or advanced driver-assistance displays, though the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80535
The Linux kernel has a vulnerability in the XFS filesystem's directory repair code, where it could attempt to lock the same inode twice when handling a self-referential directory, potentially causing a system hang or crash. An attacker with local access could exploit this to disrupt system availability. This could be relevant where the Linux kernel with XFS is deployed in automotive systems, such as infotainment or telematics units; confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80533
The advisory describes a bug fix in the Linux kernel's XFS filesystem repair code, where a null buffer pointer could cause the system to walk off the end of memory during AGI repair, potentially leading to a crash or memory corruption. The affected component is the XFS filesystem implementation, which is a generic storage technology not specifically tied to automotive systems. This could be relevant where XFS is deployed in automotive systems, such as in infotainment or data storage units, but the advisory does not confirm any automotive impact. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80534
The advisory describes a bug in the Linux kernel's XFS filesystem where a lock on the quota inode is not released if an error occurs during a specific operation, potentially causing subsequent quota operations to hang. This is a general kernel issue with no stated automotive connection, but it could be relevant where Linux-based systems with XFS are deployed in automotive or embedded contexts. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80531
The advisory describes a use-after-free vulnerability in the Linux kernel's XFS filesystem repair code, where a temporary inode pointer could be accessed after being freed if tempfile creation fails. An attacker could potentially exploit this to cause memory corruption or a system crash. The severity is not explicitly stated, but it is a kernel-level bug fix. This could be relevant where the Linux kernel with XFS is deployed in automotive systems, such as infotainment or telematics units. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80532
This advisory addresses a bug in the Linux kernel's XFS filesystem, specifically in the online filesystem check (fsck) function that reconstructs inode unlinked lists. An attacker could exploit this flaw to cause an infinite loop, leading to a denial of service by hanging the system. The severity is not explicitly stated, but the issue is a kernel-level bug that could be relevant where XFS is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80530
The advisory describes a bug in the Linux kernel's XFS filesystem where exchanging file ranges can incorrectly clear a data-sharing flag, potentially leading to data corruption between linked files. An attacker could exploit this to corrupt data, though the advisory does not state a specific severity rating. This could be relevant where Linux systems with XFS are deployed in automotive or embedded platforms, so confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80528
The advisory describes a kernel crash in the Linux operating system caused by a bug in the Ceph filesystem client, where memory allocation during MDS reply processing can trigger filesystem reclaim that misinterprets Ceph-private data as a journal handle, leading to a system crash. The fix prevents this by scoping memory allocations to avoid reclaim recursion. This could be relevant where Linux with the Ceph filesystem is deployed in automotive systems, such as in-vehicle infotainment or telematics servers, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80529
The advisory describes a bug in the Linux kernel's XFS filesystem where errors from validating recovered disk quota (dquot) data during log recovery are incorrectly discarded, allowing corrupted quota buffers to be written back to disk. An attacker could potentially exploit this to cause data corruption or system instability. This could be relevant where the Linux kernel with XFS is deployed in automotive systems, such as in infotainment or telematics units; confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80526
The advisory describes a vulnerability in the Linux kernel's tas2562 audio codec driver, where the volume control function fails to validate user-supplied values, potentially allowing an attacker to overflow a fixed-size array and write arbitrary data to the device. The stated technical impact is a potential memory corruption or device malfunction, though no specific severity rating is provided in the advisory. This could be relevant where the tas2562 audio codec is deployed in automotive infotainment or audio systems, but the advisory does not confirm automotive use; confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80527
This advisory addresses a bug in the Linux kernel's Ceph file system client that can cause a read operation to hang indefinitely when the MDS (metadata server) revokes file-read capabilities. The fix implements a timeout and a fallback renewal path to prevent the permanent hang. The affected component is the Linux kernel's Ceph client, which is not inherently automotive-specific, but this could be relevant where Linux-based systems with Ceph storage are deployed in automotive or fleet/telematics infrastructure. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80523
The advisory addresses a Linux kernel fix for the SpacemiT K3 clock driver, where the HDMA clock is set as critical to prevent it from being shut off, which could otherwise cause the Linux system to hang, such as during a vector instruction page fault. The affected component is the clock driver for the SpacemiT K3 SoC, and the technical impact is a system hang due to the clock being disabled. This could be relevant where the SpacemiT K3 SoC is deployed in automotive systems, as it is a RISC-V-based processor, but the advisory does not confirm automotive use; confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80524
The advisory addresses a NULL pointer dereference vulnerability in the Linux kernel's OP-TEE driver, specifically in the function optee_ffa_lend_protmem, where a missing check on an allocated pointer could cause a crash under memory pressure. An attacker could potentially exploit this to trigger a denial-of-service condition, though the advisory does not state a severity rating. This could be relevant where the Linux kernel with the OP-TEE driver is deployed in automotive systems, such as for secure firmware management, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80521
The advisory describes a vulnerability in the Linux kernel's Unix domain socket (af_unix) implementation, where a race condition could cause the garbage collector to incorrectly free a socket connection, potentially leading to memory corruption or a system crash. The affected component is the Linux kernel itself, which is a generic operating system component. This could be relevant where Linux is deployed in automotive systems, such as in infotainment, telematics, or control units. Confirm applicability through the product SBOM or dependency inventory. The advisory does not state a severity rating.
cvelistv5medium
cve-2026-80522
The advisory describes a fix for a memory-safety bug in the Linux kernel's Tegra cryptographic driver, where an incorrect calculation could cause a write beyond a buffer during a decryption operation, potentially leading to a crash. The affected component is a kernel crypto driver for NVIDIA Tegra system-on-chip hardware, which could be relevant in automotive systems that use Tegra-based infotainment or compute modules. This could be relevant where Tegra crypto drivers are deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory. The advisory does not state a severity rating but indicates the bug could cause a crash due to an out-of-bounds write.
cvelistv5medium
cve-2026-80520
The advisory addresses a NULL pointer dereference vulnerability in the Linux kernel's ovpn component, where the code assumes both crypto key slots are populated and dereferences them without checking for NULL. An attacker could exploit this flaw to cause a system crash or denial of service when a peer has only one installed key and the kill path is asked to remove a missing key. This could be relevant where the Linux kernel's ovpn component is deployed in automotive systems, such as for VPN-based telematics or fleet connectivity; confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-74754
The advisory addresses a race condition in the Linux kernel's SCSI error handling, where a power-management flag could change mid-operation, causing an unmatched runtime power reference and a potential usage-count underflow. An attacker could exploit this to destabilize the system, though the advisory does not state a severity rating. This could be relevant where the Linux kernel's SCSI subsystem is deployed in automotive systems, such as for storage or telematics, but the advisory does not confirm vehicle use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-80519
This advisory describes a bug fix in the Linux kernel's OpenVPN (ovpn) networking component. The issue involves improper cleanup of encryption callbacks, which could allow a peer reference to be released too early, potentially causing a system crash or instability during module removal. The severity is not explicitly stated, but the fix addresses a use-after-free risk in kernel memory management. This could be relevant where the Linux kernel's ovpn component is deployed in automotive systems, such as for secure vehicle connectivity. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-74753
The advisory addresses a vulnerability in the Linux kernel's performance event subsystem, where a flaw allows a newly created event to be linked to an already exited event that is still open via a file descriptor. An attacker could exploit this to cause a use-after-free condition, where a pointer references freed memory, potentially leading to system instability or privilege escalation. The severity is not explicitly rated in the advisory, but the fix involves rejecting exited events as group leaders to prevent this unsafe linkage. This could be relevant where the Linux kernel is deployed in automotive systems, such as in infotainment or control units, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-74751
The advisory describes a bug in the Linux kernel's ZBB-optimized strnlen function for RISC-V architecture, where the code could read one word past the intended boundary, potentially causing a memory fault if that address is unmapped. An attacker could potentially exploit this to cause a denial-of-service condition by crashing the system. This could be relevant where RISC-V-based Linux systems are deployed in automotive applications, such as in vehicle control units or infotainment systems, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-74749
The advisory addresses a bug in the Linux kernel's rseq feature, where a race condition could cause a system hard lockup when a process is granted an extended time slice. An attacker could potentially trigger this lockup, leading to a denial of service by freezing the system. The severity is not explicitly rated, but the issue is described as a livelock risk that is caught by kernel locking diagnostics. This could be relevant where the Linux kernel is deployed in automotive systems, such as in infotainment or control units. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-74750
This advisory addresses a bug in the Linux kernel's OpenVPN (ovpn) module, where cryptographic key data was being freed in a way that could cause errors or crashes with certain hardware-based encryption implementations. An attacker could potentially exploit this flaw to cause a denial-of-service condition, though the advisory does not specify a severity rating. This could be relevant where the Linux kernel's ovpn module is deployed in automotive systems, such as for secure vehicle communications. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-74747
The advisory addresses a vulnerability in the Linux kernel's IPVS component, where an attacker could alter the IP header length field to cause out-of-bounds memory access, potentially leading to a system crash or other undefined behavior. The fix adds a check to drop such malicious packets, and the severity is not explicitly stated in the advisory. This could be relevant where IPVS is deployed in automotive systems, such as for network load balancing in vehicle infrastructure, but the advisory does not confirm automotive use; confirm applicability through the product SBOM or dependency inventory.
cvelistv5medium
cve-2026-74744
This advisory describes a bug in the Linux kernel's ipvlan networking feature, where the software fails to reserve enough memory space for network data packets when used on top of certain other networking technologies like tunnels or security layers. An attacker could exploit this flaw to cause system crashes or memory corruption. The severity is not explicitly rated, but the impact involves system instability and potential security failures. This could be relevant where ipvlan is deployed in automotive systems, such as for in-vehicle network segmentation or telematics, but the advisory does not confirm vehicle use. Confirm applicability through the product SBOM or dependency inventory.