huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Lua library commands may lead to integer overflow and potential RCE
CVE: CVE-2025-46817
Component: redis
CWE: CWE-190
Severity: Moderate
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-10-03T17:52:48.478000+00:00

An integer overflow present in the Redis Lua scripting engine that allows an authenticated client to submit a specially crafted Lua script (for example via EVAL/EVALSHA) that can trigger memory corruption and potentially lead to remote code execution within the Redis server process.

Statement: This is classified as Moderate because exploitation requires an authenticated client with permission to execute Lua scripts (for example via EVAL/EVALSHA) rather than an unauthenticated network attacker, narrowing the exposure to already trusted principals or compromised application identities. The flaw is an integer overflow in Lua script handling that can corrupt memory, but reliable code execution is non-trivial and there are no public proofs of concept or known in-the-wild exploits as of the initial advisories, which lowers immediate operational risk despite the theoretical impact. Practically, triggering a controlled overflow through the embedded Lua runtime adds exploit complexity, as the attacker must shape arithmetic and memory behavior inside Redis’s scripting environment to gain control flow, increasing the likelihood of crashes over deterministic RCE in typical configurations. Even in a worst case, the effect is within the Redis server process context rather than a guaranteed system-wide compromise, further reducing systemic blast radius if the service is not over-privileged.

This flaw exists only in the Redis server implementation; 

Redis client libraries (Python, Node.js, Rust, etc.) are not affected by this vulnerability, and it only exists in the Redis server’s embedded Lua engine where scripts execute. Client libraries merely transmit EVAL/EVALSHA to the server.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.

To reduce the risk, restricting network access to trusted hosts, enforcing strong authentication and protected-mode, disabling or limiting Lua scripting where possible can be be benificial and apply least-privilege ACLs to reduce who can run scripting commands, keep instances non-public with firewalls/VPCs, and follow Redis hardening guidance to minimize exposure.
smb: client: add NULL check in automount_fullpath
CVE: CVE-2025-38208
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

smb: client: add NULL check in automount_fullpath

page is checked for null in __build_path_from_dentry_optional_prefix
when tcon->origin_fullpath is not set. However, the check is missing when
it is set.
Add a check to prevent a potential NULL pointer dereference.


Remediation:
World-Writable Cache Directory Vulnerability in llama_index
CVE: CVE-2025-7707
Component: llama-index
CWE: CWE-377
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Release date: 2025-10-13T16:15:08.249000+00:00

The llama_index library sets the NLTK data directory to a subdirectory of the codebase by default (e.g., _static/nltk_cache inside the package directory). In multi-user environments or shared hosting, this directory is world-writable or accessible by multiple users. As a result, any user can overwrite, delete, or corrupt NLTK data files, leading to denial of service, data tampering, or potentially privilege escalation if a vulnerable data loader is present.

Statement: Availability impact of this flaw is limited to the application which bundles llama_index. The host operating system is not at risk of availability impact.

Remediation:
Gitea: Information disclosure via anonymous access to private user projects
CVE: CVE-2025-68945
Component: gitea
CWE: CWE-359
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-12-26T03:58:46.724000+00:00

A flaw was found in Gitea. An anonymous user can exploit this vulnerability by visiting a private user's project, leading to unauthorized information disclosure. This allows an attacker to view details of projects that should remain private.

Statement: This vulnerability is rated Moderate. In the Red Hat context, impact is limited as the vulnerable code is not present in Red Hat OpenShift Pipelines components.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
drm/xe/userptr: fix EFAULT handling
CVE: CVE-2025-21880
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-03-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/userptr: fix EFAULT handling

Currently we treat EFAULT from hmm_range_fault() as a non-fatal error
when called from xe_vm_userptr_pin() with the idea that we want to avoid
killing the entire vm and chucking an error, under the assumption that
the user just did an unmap or something, and has no intention of
actually touching that memory from the GPU.  At this point we have
already zapped the PTEs so any access should generate a page fault, and
if the pin fails there also it will then become fatal.

However it looks like it's possible for the userptr vma to still be on
the rebind list in preempt_rebind_work_func(), if we had to retry the
pin again due to something happening in the caller before we did the
rebind step, but in the meantime needing to re-validate the userptr and
this time hitting the EFAULT.

This explains an internal user report of hitting:

[  191.738349] WARNING: CPU: 1 PID: 157 at drivers/gpu/drm/xe/xe_res_cursor.h:158 xe_pt_stage_bind.constprop.0+0x60a/0x6b0 [xe]
[  191.738551] Workqueue: xe-ordered-wq preempt_rebind_work_func [xe]
[  191.738616] RIP: 0010:xe_pt_stage_bind.constprop.0+0x60a/0x6b0 [xe]
[  191.738690] Call Trace:
[  191.738692]  <TASK>
[  191.738694]  ? show_regs+0x69/0x80
[  191.738698]  ? __warn+0x93/0x1a0
[  191.738703]  ? xe_pt_stage_bind.constprop.0+0x60a/0x6b0 [xe]
[  191.738759]  ? report_bug+0x18f/0x1a0
[  191.738764]  ? handle_bug+0x63/0xa0
[  191.738767]  ? exc_invalid_op+0x19/0x70
[  191.738770]  ? asm_exc_invalid_op+0x1b/0x20
[  191.738777]  ? xe_pt_stage_bind.constprop.0+0x60a/0x6b0 [xe]
[  191.738834]  ? ret_from_fork_asm+0x1a/0x30
[  191.738849]  bind_op_prepare+0x105/0x7b0 [xe]
[  191.738906]  ? dma_resv_reserve_fences+0x301/0x380
[  191.738912]  xe_pt_update_ops_prepare+0x28c/0x4b0 [xe]
[  191.738966]  ? kmemleak_alloc+0x4b/0x80
[  191.738973]  ops_execute+0x188/0x9d0 [xe]
[  191.739036]  xe_vm_rebind+0x4ce/0x5a0 [xe]
[  191.739098]  ? trace_hardirqs_on+0x4d/0x60
[  191.739112]  preempt_rebind_work_func+0x76f/0xd00 [xe]

Followed by NPD, when running some workload, since the sg was never
actually populated but the vma is still marked for rebind when it should
be skipped for this special EFAULT case. This is confirmed to fix the
user report.

v2 (MattB):
 - Move earlier.
v3 (MattB):
 - Update the commit message to make it clear that this indeed fixes the
   issue.

(cherry picked from commit 6b93cb98910c826c2e2004942f8b060311e43618)


Remediation:
smb: client: Avoid race in open_cached_dir with lease breaks
CVE: CVE-2025-37954
Component: kernel
Severity: Moderate
CVSS v3: 4.9/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

smb: client: Avoid race in open_cached_dir with lease breaks

A pre-existing valid cfid returned from find_or_create_cached_dir might
race with a lease break, meaning open_cached_dir doesn't consider it
valid, and thinks it's newly-constructed. This leaks a dentry reference
if the allocation occurs before the queued lease break work runs.

Avoid the race by extending holding the cfid_list_lock across
find_or_create_cached_dir and when the result is checked.

Statement: Fixes a race in SMB client cached directory handling causing dentry ref leaks. The security impact is limited. Only affects systems under active SMB usage with directory caching and lease breaks.

Remediation:
fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST
CVE: CVE-2025-71267
Component: kernel
Severity: None
Release date: 2025-01-01T00:00:00+00:00

No description is available for this CVE.


Remediation:
Remote code execution when loading a crafted GraphQL schema
CVE: CVE-2025-27407
Component: graphql-ruby
CWE: CWE-94
Severity: Important
CVSS v3: 8.3/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2025-03-12T18:15:57.957000+00:00

A flaw was found in graphql-ruby. In affected versions of graphq-ruby, loading a malicious schema definition in the `GraphQL::Schema.from_introspection` or the `GraphQL::Schema::Loader.load` can cause remote code execution. Any system that loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection.

Statement: This vulnerability is marked as Important rather than Critical because interaction with the vulnerable GraphQL library is restricted to only authenticated users in Red Hat Satellite. Satellite does not dynamically load schemas from external sources, further reducing the feasibility of exploitation.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.14/html/updating_red_hat_satellite/index
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.15/html/updating_red_hat_satellite/index
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.16/html/updating_red_hat_satellite/index
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index
A successful exploitation of this flaw requires GraphQL schema loading. Limiting the schema loading to trusted or authenticated users will limit the impact of the vulnerability. Coupling that with a strict input validation for all GraphQL schema being loaded would reduce the risk of a successful attack and cover as a possible mitigation strategy for this vulnerability.
usb: chipidea: ci_hdrc_imx: fix usbmisc handling
CVE: CVE-2025-37811
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: chipidea: ci_hdrc_imx: fix usbmisc handling

usbmisc is an optional device property so it is totally valid for the
corresponding data->usbmisc_data to have a NULL value.

Check that before dereferencing the pointer.

Found by Linux Verification Center (linuxtesting.org) with Svace static
analysis tool.


Remediation:
CVE: CVE-2025-15063
Component: Ollama MCP Server execAsync Command Injection Remote Code Execution Vulnerability
Release date: 2025-01-01T00:00:00+00:00

Ollama MCP Server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ollama MCP Server. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the execAsync method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27683.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
DOMPurify: Cross-site scripting
CVE: CVE-2025-15599
Component: DOMPurify
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-01-01T00:00:00+00:00

DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like </textarea> in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
HDF5 H5FL.c H5FL__blk_gc_list use after free
CVE: CVE-2025-2913
Component: hdf5
CWE: CWE-416
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-03-28T16:31:04.298000+00:00

A flaw was found in HDF5. This vulnerability allows use-after-free via manipulating the argument H5FL_blk_head_t in the function H5FL__blk_gc_list.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Rack memory exhaustion denial of service
CVE: CVE-2025-61772
Component: rack
CWE: CWE-400
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-10-07T15:02:09.895000+00:00

A denial of service flaw has been found in the rubygems rack package. `Rack::Multipart::Parser` can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (`CRLFCRLF`). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS).

Statement: The availability risk to Red Hat systems is limited to the application which has integrated rack. The host operating system availability is not at risk.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
bus: mhi: host: Fix race between unprepare and queue_buf
CVE: CVE-2025-23151
Component: kernel
CWE: CWE-366
Severity: Low
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bus: mhi: host: Fix race between unprepare and queue_buf

A client driver may use mhi_unprepare_from_transfer() to quiesce
incoming data during the client driver's tear down. The client driver
might also be processing data at the same time, resulting in a call to
mhi_queue_buf() which will invoke mhi_gen_tre(). If mhi_gen_tre() runs
after mhi_unprepare_from_transfer() has torn down the channel, a panic
will occur due to an invalid dereference leading to a page fault.

This occurs because mhi_gen_tre() does not verify the channel state
after locking it. Fix this by having mhi_gen_tre() confirm the channel
state is valid, or return error to avoid accessing deinitialized data.

[mani: added stable tag]


Remediation:
ice: ice_adapter: release xa entry on adapter allocation failure
CVE: CVE-2025-40185
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-11-12T00:00:00+00:00

A NULL pointer dereference exists in the Linux kernel such that  (ice: ice_adapter) fails to release a reserved XArray entry when ice_adapter_new() fails. As a result, subsequent insertions at the same index may return -EBUSY, which can lead to damage to system availability, integrity, and confidentiality.

Statement: ice_adapter_get() leaked a reserved XArray entry on adapter allocation failure, causing subsequent inserts to fail and potentially leading to a NULL pointer dereference. Impact is local DoS in the Intel ICE driver initialization path. Practical triggering typically requires privileged control over PCI/driver binding (hence for the CVSS the PR:H).

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
wifi: at76c50x: fix use after free access in at76_disconnect
CVE: CVE-2025-37796
Component: kernel
Severity: None
Release date: 2025-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: at76c50x: fix use after free access in at76_disconnect

The memory pointed to by priv is freed at the end of at76_delete_device
function (using ieee80211_free_hw). But the code then accesses the udev
field of the freed object to put the USB device. This may also lead to a
memory leak of the usb device. Fix this by using udev from interface.


Remediation:
tcp: Correct signedness in skb remaining space calculation
CVE: CVE-2025-38463
Component: kernel
CWE: CWE-681
Severity: Moderate
CVSS v3: 7.4/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tcp: Correct signedness in skb remaining space calculation

Syzkaller reported a bug [1] where sk->sk_forward_alloc can overflow.

When we send data, if an skb exists at the tail of the write queue, the
kernel will attempt to append the new data to that skb. However, the code
that checks for available space in the skb is flawed:
'''
copy = size_goal - skb->len
'''

The types of the variables involved are:
'''
copy: ssize_t (s64 on 64-bit systems)
size_goal: int
skb->len: unsigned int
'''

Due to C's type promotion rules, the signed size_goal is converted to an
unsigned int to match skb->len before the subtraction. The result is an
unsigned int.

When this unsigned int result is then assigned to the s64 copy variable,
it is zero-extended, preserving its non-negative value. Consequently, copy
is always >= 0.

Assume we are sending 2GB of data and size_goal has been adjusted to a
value smaller than skb->len. The subtraction will result in copy holding a
very large positive integer. In the subsequent logic, this large value is
used to update sk->sk_forward_alloc, which can easily cause it to overflow.

The syzkaller reproducer uses TCP_REPAIR to reliably create this
condition. However, this can also occur in real-world scenarios. The
tcp_bound_to_half_wnd() function can also reduce size_goal to a small
value. This would cause the subsequent tcp_wmem_schedule() to set
sk->sk_forward_alloc to a value close to INT_MAX. Further memory
allocation requests would then cause sk_forward_alloc to wrap around and
become negative.

[1]: https://syzkaller.appspot.com/bug?extid=de6565462ab540f50e47

Statement: A signedness bug in the Linux TCP stack allowed incorrect calculation of remaining buffer space, leading to overflow of sk_forward_alloc.
This may result in memory corruption or kernel crashes when specific traffic patterns or repair mode (TCP_REPAIR) are used.
For the Red Hat Enterprise Linux the "Fixes" patch not applied yet, so not actual (the patch ID is 270a1c3de47e49dd2fc18f48e46b101e48050e78).
The issue can potentially be triggered remotely if more than 2GB of data is sent within a single TCP connection and several additional conditions are met, including a vulnerable kernel with support for MSG_SPLICE_PAGES and specific memory allocation behavior such as a reduced size_goal due to TCP window constraints.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-9871
Component: Razer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability
Release date: 2025-09-30T19:36:06.923000+00:00

Razer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Razer Chroma SDK installer. By creating a symbolic link, an attacker can abuse the installer to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26373.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: