huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
scsi: qla2xxx: Fix improper freeing of purex item
CVE: CVE-2025-68741
Component: kernel
CWE: CWE-763
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix improper freeing of purex item

In qla2xxx_process_purls_iocb(), an item is allocated via
qla27xx_copy_multiple_pkt(), which internally calls
qla24xx_alloc_purex_item().

The qla24xx_alloc_purex_item() function may return a pre-allocated item
from a per-adapter pool for small allocations, instead of dynamically
allocating memory with kzalloc().

An error handling path in qla2xxx_process_purls_iocb() incorrectly uses
kfree() to release the item. If the item was from the pre-allocated
pool, calling kfree() on it is a bug that can lead to memory corruption.

Fix this by using the correct deallocation function,
qla24xx_free_purex_item(), which properly handles both dynamically
allocated and pre-allocated items.


Remediation:
CVE: CVE-2025-46613
Component: From CVEorg collector
Release date: 2025-04-25T00:00:00+00:00

OpenPLC 3 through 64f9c11 has server.cpp Memory Corruption because a thread may access handleConnections arguments after the parent stack frame becomes unavailable.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Loading a malicious hook library can lead to local privilege escalation
CVE: CVE-2025-32801
Component: kea
CWE: CWE-267
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-05-28T00:00:00+00:00

A flaw was found in the Kea package, where an unprivileged user can instruct Kea to load a hook library from any arbitrary local file. This hook can then be executed using the same privileges that Kea runs under. This vulnerability allows an attacker with access to a local, unprivileged account to introduce a malicious local hook library, which Kea will execute, achieving arbitrary code execution and privilege escalation.

Statement: This vulnerability is  rated as an Important severity because the vulnerability was found in the configuration and API directives related to hook library loading, it is a local privilege escalation flaw triggered when an attacker with local unprivileged access instructs Kea to load a malicious hook library, which is possible if the API entry points are unsecured or control sockets are in insecure paths. This leads to arbitrary code execution enabling an attacker to gain unauthorized access to sensitive data, alter critical system configurations, and disrupt service availability.

Remediation:
This vulnerability can be mitigated via one of the two following alternatives:

1) Disable the Kea API entirely by disabling the kea-ctrl-agent and removing any control-socket stanzas from the Kea configuration files.

2) Configure the API to require authentication for the kea-ctrl-agent and configuring all "control-socket" stanzes to use a directory restricted to trusted users.
iio: light: Add check for array bounds in veml6075_read_int_time_ms
CVE: CVE-2025-40114
Component: kernel
CWE: CWE-129
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-04-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iio: light: Add check for array bounds in veml6075_read_int_time_ms

The array contains only 5 elements, but the index calculated by
veml6075_read_int_time_index can range from 0 to 7,
which could lead to out-of-bounds access. The check prevents this issue.

Coverity Issue
CID 1574309: (#1 of 1): Out-of-bounds read (OVERRUN)
overrun-local: Overrunning array veml6075_it_ms of 5 4-byte
elements at element index 7 (byte offset 31) using
index int_index (which evaluates to 7)

This is hardening against potentially broken hardware. Good to have
but not necessary to backport.


Remediation:
Python future unintended import
CVE: CVE-2025-50817
Component: pypi-future
CWE: CWE-94
Severity: Important
CVSS v3: 7.5/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Release date: 2025-08-14T00:00:00+00:00

An unintended import flaw was found in the PyPI future package. When the module is loaded, it automatically imports test.py if present in the same directory or the sys.path. This behavior allows an attacker who can write files to the server to execute arbitrary code.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Vim for Windows: Uncontrolled search path vulnerability allows arbitrary code execution
CVE: CVE-2025-66476
Component: vim
CWE: CWE-427
Severity: None
CVSS v3: 0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2025-12-02T21:49:24.672000+00:00

An uncontrolled search-path vulnerability in Vim for Microsoft Windows allows an attacker who can place a trojanized executable in a directory opened by the user to cause Vim to run that executable when Vim invokes external commands (for example :grep, :!, filters !, :make, or system() in Vimscript). This can result in arbitrary code execution with the privileges of the user running Vim. The issue only affects Vim on Windows platforms (ms-win builds) and is not triggered on Unix-like systems.

Statement: This flaw is specific to Vim on Microsoft Windows systems and arises from Windows-only search-path behavior when external commands are invoked. The vulnerable code path does not exist in Vim builds for Linux. As a result, Red Hat products are not affected by this vulnerability.

Remediation:
drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
CVE: CVE-2025-39934
Component: kernel
Severity: None
Release date: 2025-10-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ

If the interrupt occurs before resource initialization is complete, the
interrupt handler/worker may access uninitialized data such as the I2C
tcpc_client device, potentially leading to NULL pointer dereference.


Remediation:
f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode
CVE: CVE-2025-38626
Component: kernel
Severity: None
Release date: 2025-08-22T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode

w/ "mode=lfs" mount option, generic/299 will cause system panic as below:

------------[ cut here ]------------
kernel BUG at fs/f2fs/segment.c:2835!
Call Trace:
 <TASK>
 f2fs_allocate_data_block+0x6f4/0xc50
 f2fs_map_blocks+0x970/0x1550
 f2fs_iomap_begin+0xb2/0x1e0
 iomap_iter+0x1d6/0x430
 __iomap_dio_rw+0x208/0x9a0
 f2fs_file_write_iter+0x6b3/0xfa0
 aio_write+0x15d/0x2e0
 io_submit_one+0x55e/0xab0
 __x64_sys_io_submit+0xa5/0x230
 do_syscall_64+0x84/0x2f0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0010:new_curseg+0x70f/0x720

The root cause of we run out-of-space is: in f2fs_map_blocks(), f2fs may
trigger foreground gc only if it allocates any physical block, it will be
a little bit later when there is multiple threads writing data w/
aio/dio/bufio method in parallel, since we always use OPU in lfs mode, so
f2fs_map_blocks() does block allocations aggressively.

In order to fix this issue, let's give a chance to trigger foreground
gc in prior to block allocation in f2fs_map_blocks().


Remediation:
xgrammar Vulnerable to Denial of Service (DoS) by abusing unbounded cache in memory
CVE: CVE-2025-32381
Component: xgrammar
CWE: CWE-770
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-09T13:08:59+00:00

A flaw was found in Xgrammar. This vulnerability allows a denial of service (DoS) via unbounded memory usage when handling a large number of unique grammar inputs from untrusted sources.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
libavif Integer Overflow Buffer Overflow
CVE: CVE-2025-48174
Component: libavif
CVSS v3: 4.5/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
Release date: 2025-05-16T00:00:00+00:00

A flaw was found in libavif. This vulnerability allows a buffer overflow via a maliciously crafted AVIF file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-7283
Component: IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability
Release date: 2025-07-08T19:58:36.650000+00:00

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26219.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
LibTIFF Use-After-Free Vulnerability
CVE: CVE-2025-8176
Component: libtiff
CWE: CWE-825
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-07-26T03:32:08.851000+00:00

A flaw was found in libtiff. The `get_histogram` function in `file/tiffmedian.c` exhibits a use-after-free condition when processing a specially crafted file, allowing a local attacker to trigger memory corruption. This manipulation results in a use-after-free vulnerability, and can lead to a denial of service.

Statement: This vulnerability has been rated Important because it involves a use-after-free flaw in the get_histogram function of LibTIFF’s tiffmedian tool. Successful exploitation may allow a local attacker to execute arbitrary code or cause a denial of service, leading to loss of confidentiality, integrity, and availability.

Remediation:
For more information visit https://access.redhat.com/errata/RHSA-2025:23080
For more information visit https://access.redhat.com/errata/RHSA-2025:23078
For more information visit https://access.redhat.com/errata/RHSA-2026:3461
For more information visit https://access.redhat.com/errata/RHSA-2026:3462
For more information visit https://access.redhat.com/errata/RHSA-2025:23079
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Avahi: Denial of Service via crafted mDNS/DNS-SD announcements
CVE: CVE-2025-68468
Component: avahi
CWE: CWE-617
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in Avahi. A remote attacker can cause a Denial of Service (DoS) by sending specially crafted unsolicited announcements containing CNAME resource records. These records, when pointing to other resource records with short Time-To-Live (TTL) values, can lead to the `avahi-daemon` crashing once they expire. This vulnerability impacts the availability of services relying on Avahi's service discovery.


Remediation:
SSRF Vulnerability in langchain-community
CVE: CVE-2025-2828
Component: langchain-community
CWE: CWE-918
Severity: Important
CVSS v3: 7.4/CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
Release date: 2025-06-23T20:42:28.639000+00:00

A Server-Side Request Forgery (SSRF) flaw was found in the langchain-community package due to a lack of restriction enforcement on specific internet addresses. This flaw allows an attacker to access local services, conduct port scans, retrieve instance metadata, or interact with local network resources.

Statement: No Red Hat products are impacted by this vulnerability as the affected package version is not used.

Remediation:
net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
CVE: CVE-2025-68192
Component: kernel
CWE: CWE-824
Severity: Important
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-16T00:00:00+00:00

A kernel panic vulnerability was found in the QMI WWAN USB driver in the Linux kernel. For raw IP packets without MAC headers, skb->mac_header is left uninitialized. On ARM64 systems with strict alignment requirements, subsequent access by IPsec (xfrm) or other subsystems causes kernel panics.

Statement: This primarily affects ARM64 systems using Qualcomm QMI-based cellular modems with IPsec VPN configurations. x86 systems are less likely to trigger the alignment fault but the uninitialized value is still problematic.

Remediation:
To mitigate this issue, prevent the qmi_wwan module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.
netmem: prevent TX of unreadable skbs
CVE: CVE-2025-21954
Component: kernel
CWE: CWE-1287
Severity: Low
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netmem: prevent TX of unreadable skbs

Currently on stable trees we have support for netmem/devmem RX but not
TX. It is not safe to forward/redirect an RX unreadable netmem packet
into the device's TX path, as the device may call dma-mapping APIs on
dma addrs that should not be passed to it.

Fix this by preventing the xmit of unreadable skbs.

Tested by configuring tc redirect:

sudo tc qdisc add dev eth1 ingress
sudo tc filter add dev eth1 ingress protocol ip prio 1 flower ip_proto \
	tcp src_ip 192.168.1.12 action mirred egress redirect dev eth1

Before, I see unreadable skbs in the driver's TX path passed to dma
mapping APIs.

After, I don't see unreadable skbs in the driver's TX path passed to dma
mapping APIs.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Processing maliciously crafted web content may lead to an unexpected Safari crash
CVE: CVE-2025-43368
Component: webkitgtk
CWE: CWE-416
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-09-23T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.

Statement: To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.

Remediation:
Do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
um: work around sched_yield not yielding in time-travel mode
CVE: CVE-2025-37880
Component: kernel
CWE: CWE-667
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-05-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

um: work around sched_yield not yielding in time-travel mode

sched_yield by a userspace may not actually cause scheduling in
time-travel mode as no time has passed. In the case seen it appears to
be a badly implemented userspace spinlock in ASAN. Unfortunately, with
time-travel it causes an extreme slowdown or even deadlock depending on
the kernel configuration (CONFIG_UML_MAX_USERSPACE_ITERATIONS).

Work around it by accounting time to the process whenever it executes a
sched_yield syscall.

Statement: The security impact is limited, because no actual fail (but instead only slow-down). Red Hat Enterprise Linux not affected (all versions).

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Jenkins storage of authorization tokens in cleartext
CVE: CVE-2025-67637
Component: org.jenkins-ci.main/jenkins-core
CWE: CWE-312
Severity: Moderate
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-12-10T16:50:36.942000+00:00

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
nilfs2: protect access to buffers with no active references
CVE: CVE-2025-21811
Component: kernel
CWE: CWE-416
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: protect access to buffers with no active references

nilfs_lookup_dirty_data_buffers(), which iterates through the buffers
attached to dirty data folios/pages, accesses the attached buffers without
locking the folios/pages.

For data cache, nilfs_clear_folio_dirty() may be called asynchronously
when the file system degenerates to read only, so
nilfs_lookup_dirty_data_buffers() still has the potential to cause use
after free issues when buffers lose the protection of their dirty state
midway due to this asynchronous clearing and are unintentionally freed by
try_to_free_buffers().

Eliminate this race issue by adjusting the lock section in this function.


Remediation:
Openjpeg NULL pointer dereference
CVE: CVE-2025-50952
Component: openjpeg
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-08-07T00:00:00+00:00

A null pointer dereference vulnerability has been discovered in the openjpeg library. This flaw, identified through a fuzzing tool, could allow an attacker to cause a crash in an application processing a specially crafted file. While no active exploit has been demonstrated, a successful attack would lead to a denial-of-service condition. This presents a risk to the availability of systems that utilize openjpeg to process untrusted input.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
GOAWAY HTTP/2 frames cause memory leak outside heap
CVE: CVE-2025-23085
Component: nodejs
CWE: CWE-400
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-01-21T00:00:00+00:00

A vulnerability was found in NodeJS when handling HTTP/2 connections, where the remote peer abruptly closes the socket without sending the proper HTTP/2 notification to the server, leading to a memory leak. This flaw allows an attacker to force the targeted process in the targeted host to an uncontrollable resource consumption state, starving the process and possibly other processes running at the same host to memory starvation, leading to a denial of service.


Remediation:
There's no available mitigation for this issue other than updating to the package version which contains the fix.
dmaengine: idxd: Remove improper idxd_free
CVE: CVE-2025-39871
Component: kernel
Severity: None
Release date: 2025-09-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: Remove improper idxd_free

The call to idxd_free() introduces a duplicate put_device() leading to a
reference count underflow:
refcount_t: underflow; use-after-free.
WARNING: CPU: 15 PID: 4428 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110
...
Call Trace:
 <TASK>
  idxd_remove+0xe4/0x120 [idxd]
  pci_device_remove+0x3f/0xb0
  device_release_driver_internal+0x197/0x200
  driver_detach+0x48/0x90
  bus_remove_driver+0x74/0xf0
  pci_unregister_driver+0x2e/0xb0
  idxd_exit_module+0x34/0x7a0 [idxd]
  __do_sys_delete_module.constprop.0+0x183/0x280
  do_syscall_64+0x54/0xd70
  entry_SYSCALL_64_after_hwframe+0x76/0x7e

The idxd_unregister_devices() which is invoked at the very beginning of
idxd_remove(), already takes care of the necessary put_device() through the
following call path:
idxd_unregister_devices() -> device_unregister() -> put_device()

In addition, when CONFIG_DEBUG_KOBJECT_RELEASE is enabled, put_device() may
trigger asynchronous cleanup via schedule_delayed_work(). If idxd_free() is
called immediately after, it can result in a use-after-free.

Remove the improper idxd_free() to avoid both the refcount underflow and
potential memory corruption during module unload.


Remediation:
vhost: vringh: Modify the return value check
CVE: CVE-2025-40051
Component: kernel
CWE: CWE-703
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

vhost: vringh: Modify the return value check

The return value of copy_from_iter and copy_to_iter can't be negative,
check whether the copied lengths are equal.

Statement: vringh incorrectly treated copy_from_iter() as potentially negative and only checked ret < 0. Since copy_from_iter() returns the number of bytes copied (non-negative), short/partial copies were falsely accepted, risking use of incomplete data and subsequent corruption/instability. The fix checks size != translated and returns -EFAULT on mismatch, properly handling faults/short copies in the vhost IOTLB translation path.
Exploitation requires local access to the vhost/virtio datapath — i.e. a process that can open and interact with /dev/vhost-* or /dev/kvm. On typical systems this means the attacker must be root or a member of the kvm group. If vhost or kvm not being used, then ordinary unprivileged users do not have access by default.

Remediation:
To mitigate this issue, prevent module vringh from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.