huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
riscv: trace: fix snapshot deadlock with sbi ecall
CVE: CVE-2026-23217
Component: kernel
Severity: None
Release date: 2026-02-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

riscv: trace: fix snapshot deadlock with sbi ecall

If sbi_ecall.c's functions are traceable,

echo "__sbi_ecall:snapshot" > /sys/kernel/tracing/set_ftrace_filter

may get the kernel into a deadlock.

(Functions in sbi_ecall.c are excluded from tracing if
CONFIG_RISCV_ALTERNATIVE_EARLY is set.)

__sbi_ecall triggers a snapshot of the ringbuffer. The snapshot code
raises an IPI interrupt, which results in another call to __sbi_ecall
and another snapshot...

All it takes to get into this endless loop is one initial __sbi_ecall.
On RISC-V systems without SSTC extension, the clock events in
timer-riscv.c issue periodic sbi ecalls, making the problem easy to
trigger.

Always exclude the sbi_ecall.c functions from tracing to fix the
potential deadlock.

sbi ecalls can easiliy be logged via trace events, excluding ecall
functions from function tracing is not a big limitation.


Remediation:
pgproto3: Denial of Service via negative field length in DataRow message
CVE: CVE-2026-4427
Component: github.com/jackc/pgproto3
CWE: CWE-129
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T13:00:31+00:00

A flaw was found in pgproto3. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message with a negative field length. This input validation vulnerability can lead to a denial of service (DoS) due to a slice bounds out of range panic.


Remediation:
PyTorch: Arbitrary code execution via malicious checkpoint file loading
CVE: CVE-2026-24747
Component: pytorch
CWE: CWE-502
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-01-27T21:13:46.878000+00:00

A flaw was found in PyTorch, a Python package for tensor computation. A remote attacker could craft a malicious checkpoint file, which, when loaded using the `weights_only` unpickler, could lead to memory corruption. This vulnerability may enable an attacker to achieve arbitrary code execution on the affected system.


Remediation:
can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error
CVE: CVE-2026-23082
Component: kernel
Severity: None
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error

In commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix
URB memory leak"), the URB was re-anchored before usb_submit_urb() in
gs_usb_receive_bulk_callback() to prevent a leak of this URB during
cleanup.

However, this patch did not take into account that usb_submit_urb() could
fail. The URB remains anchored and
usb_kill_anchored_urbs(&parent->rx_submitted) in gs_can_close() loops
infinitely since the anchor list never becomes empty.

To fix the bug, unanchor the URB when an usb_submit_urb() error occurs,
also print an info message.


Remediation:
systeminformation: Arbitrary command execution via unsanitized network interface parameter
CVE: CVE-2026-26280
Component: systeminformation
CWE: CWE-78
Severity: Important
CVSS v3: 8.4/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-19T19:43:05.868000+00:00

A flaw was found in systeminformation. An attacker can exploit a command injection vulnerability in the `wifiNetworks()` function by providing a specially crafted network interface parameter. This occurs because the parameter is not properly sanitized in a retry mechanism, allowing for the execution of arbitrary operating system commands with the privileges of the Node.js process. This could lead to a complete compromise of the affected system.


Remediation:
arm64: Set __nocfi on swsusp_arch_resume()
CVE: CVE-2026-23128
Component: kernel
CWE: CWE-354
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel on arm64 systems with Control Flow Integrity (CFI) enabled. During hibernate resume, the swsusp_arch_resume() function attempts to verify a CFI hash when calling swsusp_arch_suspend_exit(), which is marked as SYM_CODE and lacks a CFI hash. This causes a data abort (DABT) and kernel crash when resuming from hibernation, resulting in a failed resume operation.

Statement: This flaw affects arm64 systems with CFI enabled that use hibernation. Even if server or desktop Linux deployments uses hibernation, still the CFI is not universally enabled. Android-based systems using hibernation with CFI-enabled kernels are the primary affected platforms.
On arm64 systems with kernel CFI enabled, resuming from hibernation can crash due to a control flow integrity mismatch. The hibernation resume path swsusp_arch_resume calls into a copied instance of swsusp_arch_suspend_exit located in the hibernate exit text region. The referenced suspend exit entrypoint is defined using SYM_CODE and therefore does not carry a CFI type hash. When swsusp_arch_resume performs the indirect call into this copied code, CFI attempts to validate the target and fails because the expected hash is missing. On affected Android based devices this manifests as a data abort and kernel oops during resume, resulting in a denial of service by preventing successful restoration from hibernation.

Remediation:
Null Pointer Dereference in harfbuzz
CVE: CVE-2026-22693
Component: harfbuzz
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-01-10T05:53:21.019000+00:00

A null pointer dereference vector has been discovered in the harfbuzz package. A null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh:1672-1673. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault.

Statement: This MODERATE severity null pointer dereference in the HarfBuzz library may cause a denial of service (segmentation fault) when memory allocation fails in hb_malloc.

The issue affects Red Hat products that include and link against HarfBuzz, such as OpenJDK builds with the java.desktop module and certain RHEL components like Firefox and Thunderbird.

The java-17-openjdk-headless and java-21-openjdk-headless packages do not include java.desktop and do not link against HarfBuzz; therefore, headless-only environments are not affected.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
thunderbird: Use-after-free in the JavaScript Engine: JIT component
CVE: CVE-2026-2766
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:04.946000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Use-after-free in the JavaScript Engine: JIT component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
H3: Server-Sent Events injection due to improper newline sanitization
CVE: CVE-2026-33128
Component: h3
CVSS v3: 7.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Release date: 2026-03-20T09:37:07.206000+00:00

A flaw was found in H3, a minimal HTTP framework. A remote attacker can exploit this flaw by injecting malicious Server-Sent Events (SSE) due to improper sanitization of newline characters in the `formatEventStreamMessage()` and `formatEventStreamComment()` functions. An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery
CVE: CVE-2026-25506
Component: MUNGE
CWE: CWE-120
Severity: Important
CVSS v3: 7.6/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Release date: 2026-02-10T18:55:57.708000+00:00

A buffer overflow vulnerability was discovered in the MUNGE authentication daemon (munged). In affected versions, a local attacker can potentially leak secret cryptographic key material from the daemon's memory by sending a specially crafted message with an oversized address field. With the leaked key, an attacker could forge authentication credentials to impersonate any user, potentially escalating privileges in systems that rely on MUNGE for identity verification.

Statement: An Important vulnerability was discovered in `munged`. A local attacker could sending a specially crafted message to leak cryptographic key material. This could enable them to forge MUNGE credentials and impersonate any user, including a system administrator. The impact of this vulnerability is less than Critical as it cannot be exploited remotely.

Remediation:
Heap buffer overflow in Skia
CVE: CVE-2026-3931
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-03-10T00:00:00+00:00

A heap buffer overflow flaw was found in the Skia component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=417599694

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
thunderbird: Use-after-free in the Graphics: ImageLib component
CVE: CVE-2026-2789
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-02-24T13:33:20.961000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Use-after-free in the Graphics: ImageLib component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
ceph: fix oops due to invalid pointer for kfree() in parse_longname()
CVE: CVE-2026-23201
Component: kernel
Severity: None
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix oops due to invalid pointer for kfree() in parse_longname()

This fixes a kernel oops when reading ceph snapshot directories (.snap),
for example by simply running `ls /mnt/my_ceph/.snap`.

The variable str is guarded by __free(kfree), but advanced by one for
skipping the initial '_' in snapshot names. Thus, kfree() is called
with an invalid pointer.  This patch removes the need for advancing the
pointer so kfree() is called with correct memory pointer.

Steps to reproduce:

1. Create snapshots on a cephfs volume (I've 63 snaps in my testcase)

2. Add cephfs mount to fstab
$ echo "samba-fileserver@.files=/volumes/datapool/stuff/3461082b-ecc9-4e82-8549-3fd2590d3fb6      /mnt/test/stuff   ceph     acl,noatime,_netdev    0       0" >> /etc/fstab

3. Reboot the system
$ systemctl reboot

4. Check if it's really mounted
$ mount | grep stuff

5. List snapshots (expected 63 snapshots on my system)
$ ls /mnt/test/stuff/.snap

Now ls hangs forever and the kernel log shows the oops.


Remediation:
Improper search_path protection in PostgreSQL Anonymizer 2.5 allows any user with create privilege to gain superuser privileges
CVE: CVE-2026-2361
Component: PostgreSQL Anonymizer
CVSS v3: 8.3/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2026-02-11T17:48:03.805000+00:00

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a temporary view based on a function containing malicious code. When the anon.get_tablesample_ratio function is then called, the malicious code is executed with superuser privileges. This privilege elevation can be exploited by users having the CREATE privilege in PostgreSQL 15 and later. The risk is higher with PostgreSQL 14 or with instances upgraded from PostgreSQL 14 or a prior version because the creation permission on the public schema is granted by default. The problem is resolved in PostgreSQL Anonymizer 3.0.1 and further versions

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ASoC: amd: fix memory leak in acp3x pdm dma ops
CVE: CVE-2026-23190
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-14T00:00:00+00:00

A memory leak was found in the AMD ACP3x audio driver's PDM DMA operations. Memory allocated during DMA operations is not properly freed, leading to gradual memory exhaustion during audio recording or playback operations.

Statement: This affects systems with AMD Renoir/Cezanne APUs using the ACP3x audio subsystem for PDM (Pulse Density Modulation) microphone input. The leak accumulates during audio operations but requires sustained audio activity to cause significant memory pressure.

Remediation:
openCryptoki: Privilege Escalation or Data Exposure via Symlink Following
CVE: CVE-2026-23893
Component: openCryptoki
CWE: CWE-59
Severity: Moderate
CVSS v3: 6.9/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Release date: 2026-01-22T00:01:43.521000+00:00

A flaw was found in openCryptoki, a PKCS#11 library and tooling for Linux and AIX. A token-group user can exploit a symlink-following vulnerability by planting symbolic links in group-writable token directories. When an administrator runs a PKCS#11 application or administrative tool as root, it may reset ownership or permissions on existing files within these directories. This can lead to privilege escalation or the exposure of sensitive data.

Statement: This vulnerability is rated Moderate for Red Hat because it requires a local attacker with `token-group` membership to plant symbolic links in group-writable token directories. Exploitation occurs when an administrator subsequently runs a privileged `openCryptoki` application or administrative tool, leading to privilege escalation or data exposure. Red Hat systems are affected if `openCryptoki` is installed and configured with group-writable token directories.

Remediation:
To mitigate this issue, restrict membership of the token-group to only trusted administrators. This prevents untrusted local users from planting malicious symlinks in openCryptoki token directories. Changes to group membership typically require users to log out and log back in for the changes to take effect.
FreeRDP RDPGFX ResetGraphics race
CVE: CVE-2026-22851
Component: freerdp
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2026-01-14T17:43:28.114000+00:00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race condition between the RDPGFX dynamic virtual channel thread and the SDL render thread leads to a heap use-after-free. Specifically, an escaped pointer to sdl->primary (SDL_Surface) is accessed after it has been freed during RDPGFX ResetGraphics handling. This vulnerability is fixed in 3.20.1.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
stack-based buffer overflow in MagnifyImage
CVE: CVE-2026-30929
Component: ImageMagick
CWE: CWE-121
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Release date: 2026-03-09T21:46:31.861000+00:00

A flaw was found in ImageMagick. Processing a specially crafted image with the MagnifyImage function can cause a stack-based buffer overflow and memory corruption, leading to a denial of service and potentially arbitrary code execution.

Statement: To exploit this issue, an attacker needs to convince a user to process a specially crafted image.

Default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability to a denial of service.

Due to these reasons, this vulnerability has been rated with a moderate severity.

Remediation:
To reduce the risk of exploitation, avoid processing untrusted images with ImageMagick. If ImageMagick is deployed in a way that it processes files from untrusted sources automatically, consider running the application inside a container or a restricted sandbox environment to limit the potential security impact.
GIMP: Remote Code Execution via XWD file parsing vulnerability
CVE: CVE-2026-2048
Component: gimp
CWE: CWE-787
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-20T22:23:51.039000+00:00

A flaw was found in GIMP. A remote attacker can exploit this out-of-bounds write vulnerability by tricking a user into opening a specially crafted XWD (X Window Dump) file. This issue occurs due to improper validation of user-supplied data during XWD file parsing, leading to a write past the end of an allocated buffer. Successful exploitation could allow the attacker to execute arbitrary code in the context of the current process.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ImageMagick: Denial of Service due to heap overflow when processing large image profiles
CVE: CVE-2026-30883
Component: ImageMagick
CWE: CWE-120
Severity: Moderate
CVSS v3: 5.7/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Release date: 2026-03-09T21:45:55.110000+00:00

A flaw was found in ImageMagick, a free and open-source software used for editing and manipulating digital images. A local attacker could exploit this vulnerability by providing an extremely large image profile when encoding a PNG image. This could result in a heap overflow, leading to a Denial of Service (DoS), which makes the affected system or application unavailable to legitimate users.

Statement: This MODERATE impact vulnerability in ImageMagick affects Red Hat Enterprise Linux 6 ELS and 7 ELS. A heap overflow can occur when processing an extremely large image profile during PNG encoding. Exploitation requires an attacker to provide a specially crafted image file for processing.

Remediation:
To mitigate this issue, avoid processing untrusted or maliciously crafted image files with ImageMagick. Users should exercise caution when handling image files from unknown or suspicious sources.
Keycloak: Proxy bypass due to improper handling of matrix parameters in URL paths
CVE: CVE-2026-0976
Component: org.keycloak/keycloak-quarkus-server
CWE: CWE-20
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-01-15T00:00:00+00:00

A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.

Statement: This vulnerability is rated Low for Red Hat Keycloak. The flaw arises from Keycloak's acceptance of RFC-compliant matrix parameters in URL paths, which can be mishandled by certain reverse proxy configurations. This may allow an unauthenticated attacker to bypass proxy-level path filtering and potentially expose administrative or sensitive endpoints that are intended to be unreachable externally. Exploitation depends on the specific reverse proxy configuration.

Remediation:
To mitigate this issue, ensure that all administrative and sensitive endpoints within Keycloak are adequately protected by robust authentication and authorization policies, independent of any reverse proxy path filtering. Operators should review Keycloak's internal access controls to confirm that access to these endpoints is restricted to authorized users and roles.
net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup
CVE: CVE-2026-23256
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T00:00:00+00:00

No description is available for this CVE.


Remediation:
Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure
CVE: CVE-2026-20883
Component: gitea
CWE: CWE-284
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-01-22T22:01:50.840000+00:00

Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches.


Remediation:
fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling
CVE: CVE-2026-25896
Component: fast-xml-parser
CWE: CWE-79
Severity: Important
CVSS v3: 7.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Release date: 2026-02-20T20:57:48.074000+00:00

A flaw was found in fast-xml-parser. A remote attacker can exploit this vulnerability by providing a specially crafted XML input. The system incorrectly interprets a dot in a DOCTYPE entity name as a regular expression wildcard during processing. This allows the attacker to bypass security measures and inject malicious scripts, resulting in Cross-Site Scripting (XSS) when the parsed output is displayed to users.

Statement: This flaw has been assessed as IMPORTANT for Red Hat products. This vulnerability arises when the parsed XML output is subsequently rendered to users which requires the interaction of the user. The impact of this flaw is also limited to the user's browser context.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.