CVE-2025-32060 Absence of Kernel Module Signature Verification on Linux System of Infotainment ECU
Attackers with root access can load unsigned kernel modules to execute arbitrary code in kernel context, compromising the entire infotainment system.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-32060?
CVE-2025-32060 is a medium-severity vulnerability in Bosch Infotainment system ECU, published on 15 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The system suffers from the absence of a kernel module signature verification. If an attacker can execute commands on behalf of root user (due to additional vulnerabilities), then he/she is also able to load custom kernel modules to the kernel space and execute code in the kernel context. Such a flaw can lead to taking control over the entire system.
First identified on Nissan Leaf ZE1 manufactured in 2020.
Weakness: CWE-347
Which versions are affected by CVE-2025-32060?
How do I fix CVE-2025-32060?
No fix has been published for CVE-2025-32060 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-32060 being exploited?
There is no known exploitation of CVE-2025-32060 in the wild and no public exploit code.
Sources
Also known as GHSA-x78v-9635-m8h6.