huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
CVE: CVE-2025-1051
Component: Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability
Release date: 2025-05-29T21:24:43.990000+00:00

Sonos Era 300 Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Sonos Era 300 speakers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the processing of ALAC data. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the anacapa user. Was ZDI-CAN-25865.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2025-6794
Component: Marvell QConvergeConsole saveAsText Directory Traversal Remote Code Execution Vulnerability
Release date: 2025-06-27T22:58:15.719000+00:00

Marvell QConvergeConsole saveAsText Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the saveAsText method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-24913.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
bpf: Fix array bounds error with may_goto
CVE: CVE-2025-22087
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix array bounds error with may_goto

may_goto uses an additional 8 bytes on the stack, which causes the
interpreters[] array to go out of bounds when calculating index by
stack_size.

1. If a BPF program is rewritten, re-evaluate the stack size. For non-JIT
cases, reject loading directly.

2. For non-JIT cases, calculating interpreters[idx] may still cause
out-of-bounds array access, and just warn about it.

3. For jit_requested cases, the execution of bpf_func also needs to be
warned. So move the definition of function __bpf_prog_ret0_warn out of
the macro definition CONFIG_BPF_JIT_ALWAYS_ON.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
wifi: ath12k: Decrement TID on RX peer frag setup error handling
CVE: CVE-2025-39761
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2025-09-11T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: Decrement TID on RX peer frag setup error handling

Currently, TID is not decremented before peer cleanup, during error
handling path of ath12k_dp_rx_peer_frag_setup(). This could lead to
out-of-bounds access in peer->rx_tid[].

Hence, add a decrement operation for TID, before peer cleanup to
ensures proper cleanup and prevents out-of-bounds access issues when
the RX peer frag setup fails.

Found during code review. Compile tested only.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Inappropriate implementation in Extensions
CVE: CVE-2025-12431
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-11-10T20:00:14.631000+00:00

Inappropriate implementation in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
ixgbe: fix too early devlink_free() in ixgbe_remove()
CVE: CVE-2025-40091
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-10-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ixgbe: fix too early devlink_free() in ixgbe_remove()

Since ixgbe_adapter is embedded in devlink, calling devlink_free()
prematurely in the ixgbe_remove() path can lead to UAF. Move devlink_free()
to the end.

KASAN report:

 BUG: KASAN: use-after-free in ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]
 Read of size 8 at addr ffff0000adf813e0 by task bash/2095
 CPU: 1 UID: 0 PID: 2095 Comm: bash Tainted: G S  6.17.0-rc2-tnguy.net-queue+ #1 PREEMPT(full)
 [...]
 Call trace:
  show_stack+0x30/0x90 (C)
  dump_stack_lvl+0x9c/0xd0
  print_address_description.constprop.0+0x90/0x310
  print_report+0x104/0x1f0
  kasan_report+0x88/0x180
  __asan_report_load8_noabort+0x20/0x30
  ixgbe_reset_interrupt_capability+0x140/0x180 [ixgbe]
  ixgbe_clear_interrupt_scheme+0xf8/0x130 [ixgbe]
  ixgbe_remove+0x2d0/0x8c0 [ixgbe]
  pci_device_remove+0xa0/0x220
  device_remove+0xb8/0x170
  device_release_driver_internal+0x318/0x490
  device_driver_detach+0x40/0x68
  unbind_store+0xec/0x118
  drv_attr_store+0x64/0xb8
  sysfs_kf_write+0xcc/0x138
  kernfs_fop_write_iter+0x294/0x440
  new_sync_write+0x1fc/0x588
  vfs_write+0x480/0x6a0
  ksys_write+0xf0/0x1e0
  __arm64_sys_write+0x70/0xc0
  invoke_syscall.constprop.0+0xcc/0x280
  el0_svc_common.constprop.0+0xa8/0x248
  do_el0_svc+0x44/0x68
  el0_svc+0x54/0x160
  el0t_64_sync_handler+0xa0/0xe8
  el0t_64_sync+0x1b0/0x1b8

Statement: The driver called devlink_free() too early during device removal, while other parts of the adapter still accessed the embedded devlink object. This caused a use-after-free crash on device unbind operations (e.g. via sysfs). The fix defers devlink_free() until the very end of ixgbe_remove(), after all cleanup steps have completed.
Affects local environments only. Can be triggered by privileged users performing PCI hot-remove or module reload operations.
For the CVSS the privilege justification is PR:H, because Triggering the vulnerable ixgbe_remove() path requires administrative privileges (e.g., CAP_SYS_ADMIN) to unbind or unload the network driver (rmmod ixgbe or writing to /sys/bus/pci/drivers/ixgbe/unbind), which is not permitted for unprivileged users by default.

Remediation:
ASoC: codecs: wcd9335: Fix missing free of regulator supplies
CVE: CVE-2025-38259
Component: kernel
Severity: None
Release date: 2025-07-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: codecs: wcd9335: Fix missing free of regulator supplies

Driver gets and enables all regulator supplies in probe path
(wcd9335_parse_dt() and wcd9335_power_on_reset()), but does not cleanup
in final error paths and in unbind (missing remove() callback).  This
leads to leaked memory and unbalanced regulator enable count during
probe errors or unbind.

Fix this by converting entire code into devm_regulator_bulk_get_enable()
which also greatly simplifies the code.


Remediation:
CVE: CVE-2025-0569
Component: Sante PACS Server DCM File Parsing Memory Corruption Denial-of-Service Vulnerability
Release date: 2025-01-20T13:10:43.913000+00:00

Sante PACS Server DCM File Parsing Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-25303.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
PM / devfreq: Check governor before using governor->name
CVE: CVE-2025-38609
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

PM / devfreq: Check governor before using governor->name

Commit 96ffcdf239de ("PM / devfreq: Remove redundant governor_name from
struct devfreq") removes governor_name and uses governor->name to replace
it. But devfreq->governor may be NULL and directly using
devfreq->governor->name may cause null pointer exception. Move the check of
governor to before using governor->name.


Remediation:
CVE: CVE-2025-7306
Component: IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability
Release date: 2025-07-08T19:59:50.045000+00:00

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26387.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Google Chrome V8: Out-of-bounds read and write leads to heap corruption
CVE: CVE-2025-14766
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-16T22:54:47.064000+00:00

Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: This vulnerability is rated Critical for Red Hat as it affects the chromium-browser component. A remote attacker could exploit heap corruption via a crafted HTML page, leading to potential arbitrary code execution. User interaction, such as visiting a malicious website, is required for exploitation.

Remediation:
To mitigate this issue, users should avoid visiting untrusted websites or opening untrusted web content. Employing a sandboxed environment for web browsing can further reduce the risk of exploitation.
Linux kernel qla2xxx driver: Denial of Service via NULL pointer dereference during fabric async scan cleanup
CVE: CVE-2025-71236
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.9/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's qla2xxx driver. This vulnerability, a NULL pointer dereference, occurs during fabric asynchronous scan cleanup when the `qla_fab_async_scan` function attempts to free memory associated with a NULL pointer. A local user may be able to indirectly trigger this flaw through device discovery and I/O (Input/Output) workloads, leading to a kernel crash and a denial of service (DoS). There is also a conservative worst-case consideration for potential memory corruption.

Statement: A NULL pointer dereference can occur in the qla2xxx driver during fabric async scan cleanup because qla_fab_async_scan may reach the done_free_sp path with sp set to NULL and then dereference sp fields and call kref_put. This leads to a kernel crash and denial of service that can be triggered by error handling paths during fabric discovery and reset related workflows. For the CVSS the PR is L because a local user may be able to influence device discovery and IO workloads indirectly, but in many environments the trigger is more dependent on hardware and SAN events than on direct unprivileged actions. The issue is not inherently network reachable from a typical IP network perspective. Impact is denial of service via kernel crash. A conservative worst case also considers potential memory corruption impact because the failure occurs in kernel driver cleanup paths.

Remediation:
radare2 rasm2 rasm2.c memory corruption
CVE: CVE-2025-1378
Component: radare2
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-02-17T06:00:09.606000+00:00

A flaw was found in radare2 rasm2. This vulnerability allows memory corruption via local access and manipulation of the /libr/main/rasm2.c library.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Optimizer unspecified vulnerability (CPU Jul 2025)
CVE: CVE-2025-50091
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-15T19:27:45.840000+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
Fastjson: Remote Code Execution via JNDI Injection due to autoType mishandling
CVE: CVE-2025-70974
Component: fastjson
CWE: CWE-829
Severity: Critical
CVSS v3: 10/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in Fastjson, a popular Java library for converting Java objects to JSON and vice versa. This vulnerability allows a remote attacker to execute arbitrary code on a system by sending a specially crafted JSON document. The issue stems from Fastjson's "autoType" feature, which, when mishandled, can lead to Java Naming and Directory Interface (JNDI) injection. This allows an attacker to inject and execute malicious code, posing a critical risk to affected systems. This flaw has been actively exploited in real-world attacks.

Statement: In the Red Hat context, this vulnerability is rated Not Affected because the vulnerable code is not present in Red Hat products.

Remediation:
firmware: arm_scmi: Balance device refcount when destroying devices
CVE: CVE-2025-37905
Component: kernel
Severity: None
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Balance device refcount when destroying devices

Using device_find_child() to lookup the proper SCMI device to destroy
causes an unbalance in device refcount, since device_find_child() calls an
implicit get_device(): this, in turns, inhibits the call of the provided
release methods upon devices destruction.

As a consequence, one of the structures that is not freed properly upon
destruction is the internal struct device_private dev->p populated by the
drivers subsystem core.

KMemleak detects this situation since loading/unloding some SCMI driver
causes related devices to be created/destroyed without calling any
device_release method.

unreferenced object 0xffff00000f583800 (size 512):
  comm "insmod", pid 227, jiffies 4294912190
  hex dump (first 32 bytes):
    00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........
    ff ff ff ff ff ff ff ff 60 36 1d 8a 00 80 ff ff  ........`6......
  backtrace (crc 114e2eed):
    kmemleak_alloc+0xbc/0xd8
    __kmalloc_cache_noprof+0x2dc/0x398
    device_add+0x954/0x12d0
    device_register+0x28/0x40
    __scmi_device_create.part.0+0x1bc/0x380
    scmi_device_create+0x2d0/0x390
    scmi_create_protocol_devices+0x74/0xf8
    scmi_device_request_notifier+0x1f8/0x2a8
    notifier_call_chain+0x110/0x3b0
    blocking_notifier_call_chain+0x70/0xb0
    scmi_driver_register+0x350/0x7f0
    0xffff80000a3b3038
    do_one_initcall+0x12c/0x730
    do_init_module+0x1dc/0x640
    load_module+0x4b20/0x5b70
    init_module_from_file+0xec/0x158

$ ./scripts/faddr2line ./vmlinux device_add+0x954/0x12d0
device_add+0x954/0x12d0:
kmalloc_noprof at include/linux/slab.h:901
(inlined by) kzalloc_noprof at include/linux/slab.h:1037
(inlined by) device_private_init at drivers/base/core.c:3510
(inlined by) device_add at drivers/base/core.c:3561

Balance device refcount by issuing a put_device() on devices found via
device_find_child().


Remediation:
Command Injection in WINS Server Hook Script
CVE: CVE-2025-10230
Component: samba
CWE: CWE-78
Severity: Critical
CVSS v3: 10/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Release date: 2025-10-15T12:45:58.298000+00:00

A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process.

Statement: On Red Hat Enterprise Linux (RHEL) versions 6, 7, 8, 9 and 10, the Samba packages as shipped are not affected by this vulnerability. This is because Red Hat does not provide Active Directory Domain Controller (AD DC) functionality in its Samba packages, and the vulnerable wins hook execution path exists only when Samba is configured as a domain controller with WINS support enabled. As a result, the Samba deployments on RHEL cannot be exploited via this issue.

This vulnerability is considered Critical rather than Important because it enables unauthenticated remote code execution (RCE) on a Samba Active Directory Domain Controller through a trivially reachable network service. The flaw lies in the wins hook mechanism, where unvalidated NetBIOS names from incoming WINS registration packets are directly concatenated into a shell command and executed with sh -c. This means an attacker can inject arbitrary shell metacharacters and run commands with the privileges of the Samba process—often root on a DC. Unlike moderate flaws that may require authentication, complex preconditions, or result only in limited information exposure or denial of service, this issue provides a direct path to full system compromise over the network with minimal effort. The combination of remote reachability, lack of authentication, low complexity, and full confidentiality, integrity, and availability impact justifies its classification as a Critical vulnerability.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
ksmbd: fix incorrect validation for num_aces field of smb_acl
CVE: CVE-2025-21994
Component: kernel
CWE: CWE-99
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-02T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix incorrect validation for num_aces field of smb_acl

parse_dcal() validate num_aces to allocate posix_ace_state_array.

if (num_aces > ULONG_MAX / sizeof(struct smb_ace *))

It is an incorrect validation that we can create an array of size ULONG_MAX.
smb_acl has ->size field to calculate actual number of aces in request buffer
size. Use this to check invalid num_aces.


Remediation:
MARIN3R: Cross-Namespace Vulnerability in the Operator
CVE: CVE-2025-64171
Component: marin3r
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-11-06T00:23:48.695000+00:00

A cross-namespace authorization flaw has been identified in the MARIN3R operator’s DiscoveryServiceCertificate resource. The flaw occurs because the operator mistakenly treats certain inputs as valid, bypassing Kubernetes Role-Based Access Control (RBAC). When a user has permission to create DiscoveryServiceCertificate objects in one Kubernetes namespace, they could exploit the vulnerability to indirectly read Secret objects in other namespaces that they should not have access to.

Statement: The severity is considered Moderate, because exploitation can be done over the network via the K8s API (AV:N), no unusual conditions are required for the attack (AC:L), however, the attacker must already hold permissions to create DiscoveryServiceCertificate objects in some namespace, without requiring elevated privileges beyond what the user already has for creating DiscoveryServiceCertificate objects. It enables unauthorized disclosure of sensitive secrets across namespace boundaries (only confidentiality impact), without affecting integrity or availability.

Remediation:
As an interim workaround, restrict permissions so that only trusted cluster administrators can create DiscoveryServiceCertificate resources until the update is applied
Quadratic complexity when parsing some invalid inputs in encoding/pem
CVE: CVE-2025-61723
Component: encoding/pem
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-10-29T22:10:13.220000+00:00

A potential denial of service flaw has been discovered in the golang encoding/pem module. Due to the design of the PEM parsing function, the processing time for some
inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs and may result in an unresponsive program should an attacker exploit it.


Remediation:
CVE: CVE-2025-7243
Component: IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability
Release date: 2025-07-08T19:56:34.045000+00:00

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26091.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: