huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Parser unspecified vulnerability (CPU Apr 2025)
CVE: CVE-2025-21575
Component: mysql
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-15T20:30:53.635000+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).


Remediation:
wifi: mt76: mt7996: Check phy before init msta_link in mt7996_mac_sta_add_links()
CVE: CVE-2025-40066
Component: kernel
Severity: None
Release date: 2025-10-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: Check phy before init msta_link in mt7996_mac_sta_add_links()

In order to avoid a possible NULL pointer dereference in
mt7996_mac_sta_init_link routine, move the phy pointer check before
running mt7996_mac_sta_init_link() in mt7996_mac_sta_add_links routine.


Remediation:
thunderbird: Script element events leaked cross-origin resource status
CVE: CVE-2025-5266
Component: firefox
CWE: CWE-829
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-05-27T12:29:25.084000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Script elements loading cross-origin resources generate load and error events which can leak information enabling XS-Leaks attacks.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
CVE: CVE-2025-39846
Component: kernel
Severity: None
Release date: 2025-09-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()

In __iodyn_find_io_region(), pcmcia_make_resource() is assigned to
res and used in pci_bus_alloc_resource(). There is a dereference of res
in pci_bus_alloc_resource(), which could lead to a NULL pointer
dereference on failure of pcmcia_make_resource().

Fix this bug by adding a check of res.


Remediation:
netfilter: nf_tables: reject mismatching sum of field_len with set key length
CVE: CVE-2025-21826
Component: kernel
CWE: CWE-682
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Release date: 2025-03-06T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: reject mismatching sum of field_len with set key length

The field length description provides the length of each separated key
field in the concatenation, each field gets rounded up to 32-bits to
calculate the pipapo rule width from pipapo_init(). The set key length
provides the total size of the key aligned to 32-bits.

Register-based arithmetics still allows for combining mismatching set
key length and field length description, eg. set key length 10 and field
description [ 5, 4 ] leading to pipapo width of 12.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
CVE: CVE-2025-31125
Component: vite
CWE: CWE-73
Severity: Moderate
CVSS v3: 5.2/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-03-31T17:06:30.704000+00:00

A flaw was found in the Vite Node.js package. Vite exposes content of non-allowed files using `?inline&import` or `?raw?import`. Only apps explicitly exposing the Vite dev server to the network (using the `--host` or `server.host` config options) are affected.


Remediation:
NetworkManager File Access
CVE: CVE-2025-9615
Component: NetworkManager
CWE: CWE-281
Severity: Low
CVSS v3: 3.4/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-12-12T00:00:00+00:00

A flaw was found in NetworkManager. The NetworkManager package allows access to files that may belong to other users. NetworkManager allows non-root users to configure the system's network. The daemon runs with root privileges and can access files owned by users different from the one who added the connection.


Remediation:
SELinux is shipped out of the box in targeted enforcing mode, which prevents processes from having unwanted permissions and mitigates this attack.
fs/jfs: Prevent integer overflow in AG size calculation
CVE: CVE-2025-37858
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

fs/jfs: Prevent integer overflow in AG size calculation

The JFS filesystem calculates allocation group (AG) size using 1 <<
l2agsize in dbExtendFS(). When l2agsize exceeds 31 (possible with >2TB
aggregates on 32-bit systems), this 32-bit shift operation causes undefined
behavior and improper AG sizing.

On 32-bit architectures:
- Left-shifting 1 by 32+ bits results in 0 due to integer overflow
- This creates invalid AG sizes (0 or garbage values) in
sbi->bmap->db_agsize
- Subsequent block allocations would reference invalid AG structures
- Could lead to:
  - Filesystem corruption during extend operations
  - Kernel crashes due to invalid memory accesses
  - Security vulnerabilities via malformed on-disk structures

Fix by casting to s64 before shifting:
bmp->db_agsize = (s64)1 << l2agsize;

This ensures 64-bit arithmetic even on 32-bit architectures. The cast
matches the data type of db_agsize (s64) and follows similar patterns in
JFS block calculation code.

Found by Linux Verification Center (linuxtesting.org) with SVACE.


Remediation:
NULL Pointer Dereference in FFmpeg
CVE: CVE-2025-25473
Component: ffmpeg
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-02-18T00:00:00+00:00

FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
viridian: race condition when the mapping of the reference TSC page
CVE: CVE-2025-58143
Component: xen
CVSS v3: 9.2/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Release date: 2025-09-11T14:05:29.729000+00:00

A race condition exists in Xen’s viridian implementation during mapping of the reference TSC page. A malicious x86 HVM guest with the reference_tsc viridian extension enabled could exploit this flaw to cause Xen to free a page while it is still present in the guest physical-to-machine (p2m) mappings. Successful exploitation may result in a host denial of service, information disclosure, or potential privilege escalation.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Disabling the reference_tsc viridian extension for x86 HVM guests prevents exploitation of this issue.
cifs: Fix integer overflow while processing acdirmax mount option
CVE: CVE-2025-21963
Component: kernel
CWE: CWE-190
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix integer overflow while processing acdirmax mount option

User-provided mount parameter acdirmax of type u32 is intended to have
an upper limit, but before it is validated, the value is converted from
seconds to jiffies which can lead to an integer overflow.

Found by Linux Verification Center (linuxtesting.org) with SVACE.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Optimizer unspecified vulnerability (CPU Jul 2025)
CVE: CVE-2025-50089
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-15T19:27:44.785000+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 9.0.0-9.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
buffer overflow in img2sixel when processing crafted image files
CVE: CVE-2025-9300
Component: libsixel
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-21T13:02:08.108000+00:00

A flaw was found in the libsixel library. An out-of-bounds read can be triggered when a specially crafted file is processed with the img2sixel program, specifically during palette debugging operations. This issue can cause an application crash and result in a denial of service.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2025-0571
Component: Sante PACS Server Web Portal DCM File Parsing Memory Corruption Denial-of-Service Vulnerability
Release date: 2025-01-20T13:10:35.757000+00:00

Sante PACS Server Web Portal DCM File Parsing Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is required to exploit this vulnerability.

The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-25305.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
cxl/features: Add check for no entries in cxl_feature_info
CVE: CVE-2025-40089
Component: kernel
Severity: None
Release date: 2025-10-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cxl/features: Add check for no entries in cxl_feature_info

cxl EDAC calls cxl_feature_info() to get the feature information and
if the hardware has no Features support, cxlfs may be passed in as
NULL.

[   51.957498] BUG: kernel NULL pointer dereference, address: 0000000000000008
[   51.965571] #PF: supervisor read access in kernel mode
[   51.971559] #PF: error_code(0x0000) - not-present page
[   51.977542] PGD 17e4f6067 P4D 0
[   51.981384] Oops: Oops: 0000 [#1] SMP NOPTI
[   51.986300] CPU: 49 UID: 0 PID: 3782 Comm: systemd-udevd Not tainted 6.17.0dj
test+ #64 PREEMPT(voluntary)
[   51.997355] Hardware name: <removed>
[   52.009790] RIP: 0010:cxl_feature_info+0xa/0x80 [cxl_core]

Add a check for cxlfs before dereferencing it and return -EOPNOTSUPP if
there is no cxlfs created due to no hardware support.


Remediation:
vmci: Prevent the dispatching of uninitialized payloads
CVE: CVE-2025-38611
Component: kernel
Severity: None
Release date: 2025-08-19T00:00:00+00:00

No description is available for this CVE.

Statement: This CVE has been marked as Rejected by the assigning CNA.

Remediation:
tiptap/extension-link: Cross-site Scripting (XSS) via unsanitized user input in link handling
CVE: CVE-2025-14284
Component: tiptap/extension-link
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-12-09T05:00:03.409000+00:00

A flaw was found in @tiptap/extension-link. This vulnerability allows an attacker to execute arbitrary JavaScript (JS) code via unsanitized user input when setting or toggling links, by injecting a javascript: Uniform Resource Locator (URL) payload.

Statement: This vulnerability is rated Moderate for Red Hat products as it involves a Cross-site Scripting (XSS) flaw in the @tiptap/extension-link component. Exploitation requires user interaction with a specially crafted link containing a 'javascript:' URL payload. The impact is limited to the user's browser session.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
of_numa: fix uninitialized memory nodes causing kernel panic
CVE: CVE-2025-39903
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-10-01T00:00:00+00:00

A flaw was found in the linux kernel of_numa subsystem fails to properly initialize memory‑only NUMA nodes (i.e., nodes without CPUs). When such nodes remain uninitialized, a subsequent call to free_area_init() may access NODE_DATA() for those nodes and trigger a kernel panic due to a NULL pointer dereference. This can lead to a denial of service (system crash) during boot on affected kernels.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
bpf: Enforce expected_attach_type for tailcall compatibility
CVE: CVE-2025-40123
Component: kernel
CWE: CWE-843
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-11-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bpf: Enforce expected_attach_type for tailcall compatibility

Yinhao et al. recently reported:

  Our fuzzer tool discovered an uninitialized pointer issue in the
  bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem.
  This leads to a NULL pointer dereference when a BPF program attempts to
  deference the txq member of struct xdp_buff object.

The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the
entry point for bpf_prog_test_run_xdp() and its expected_attach_type can
neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot
of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP
to pass xdp_is_valid_access() validation. The program returns struct xdp_md's
egress_ifindex, and the latter is only allowed to be accessed under mentioned
expected_attach_type. progB is then inserted into the tailcall which progA
calls.

The underlying issue goes beyond XDP though. Another example are programs
of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well
as sock_addr_func_proto() have different logic depending on the programs'
expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME
should not be allowed doing a tailcall into a program which calls bpf_bind()
out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT.

In short, specifying expected_attach_type allows to open up additional
functionality or restrictions beyond what the basic bpf_prog_type enables.
The use of tailcalls must not violate these constraints. Fix it by enforcing
expected_attach_type in __bpf_prog_map_compatible().

Note that we only enforce this for tailcall maps, but not for BPF devmaps or
cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and
cpu_map_bpf_prog_run*() which set up a new environment / context and therefore
these situations are not prone to this issue.

Statement: BPF programs specify expected_attach_type to enable attach-point-specific functionality beyond the base prog_type. For XDP, BPF_XDP_DEVMAP programs can access xdp_md's egress_ifindex field, while regular XDP programs cannot. For CGROUP_SOCK_ADDR, different attach types permit different helper functions like bpf_bind. Tailcalls allow one program to jump to another, but the compatibility check only verified prog_type matches—not expected_attach_type. An attacker creates progA (e.g., regular XDP) that tailcalls into progB (e.g., XDP_DEVMAP), which then accesses fields or calls helpers it shouldn't have permission to use, causing crashes or uninitialized pointer accesses. The fix enforces expected_attach_type matching for tailcall maps.

Remediation:
out-of-buffer access
CVE: CVE-2025-43963
Component: LibRaw
CWE: CWE-125
Severity: Low
CVSS v3: 2.8/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-04-20T00:00:00+00:00

In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
iio: backend: fix out-of-bound write
CVE: CVE-2025-38484
Component: kernel
Severity: None
Release date: 2025-07-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iio: backend: fix out-of-bound write

The buffer is set to 80 character. If a caller write more characters,
count is truncated to the max available space in "simple_write_to_buffer".
But afterwards a string terminator is written to the buffer at offset count
without boundary check. The zero termination is written OUT-OF-BOUND.

Add a check that the given buffer is smaller then the buffer to prevent.


Remediation:
drm/amd/pm: Prevent division by zero
CVE: CVE-2025-37771
Component: kernel
Severity: None
Release date: 2025-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/pm: Prevent division by zero

The user can set any speed value.
If speed is greater than UINT_MAX/8, division by zero is possible.

Found by Linux Verification Center (linuxtesting.org) with SVACE.


Remediation:
Reflected XSS via question bank filter
CVE: CVE-2025-26530
Component: moodle
CVSS v3: 8.3/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2025-02-24T19:56:14.586000+00:00

The question bank filter required additional sanitizing to prevent a reflected XSS risk.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
iio: accel: bmc150: Fix irq assumption regression
CVE: CVE-2025-68330
Component: kernel
Severity: None
Release date: 2025-12-22T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iio: accel: bmc150: Fix irq assumption regression

The code in bmc150-accel-core.c unconditionally calls
bmc150_accel_set_interrupt() in the iio_buffer_setup_ops,
such as on the runtime PM resume path giving a kernel
splat like this if the device has no interrupts:

Unable to handle kernel NULL pointer dereference at virtual
  address 00000001 when read

PC is at bmc150_accel_set_interrupt+0x98/0x194
LR is at __pm_runtime_resume+0x5c/0x64
(...)
Call trace:
bmc150_accel_set_interrupt from bmc150_accel_buffer_postenable+0x40/0x108
bmc150_accel_buffer_postenable from __iio_update_buffers+0xbe0/0xcbc
__iio_update_buffers from enable_store+0x84/0xc8
enable_store from kernfs_fop_write_iter+0x154/0x1b4

This bug seems to have been in the driver since the beginning,
but it only manifests recently, I do not know why.

Store the IRQ number in the state struct, as this is a common
pattern in other drivers, then use this to determine if we have
IRQ support or not.


Remediation:
hwmon: (w83791d) Convert macros to functions to avoid TOCTOU
CVE: CVE-2025-71111
Component: kernel
CWE: CWE-367
Severity: Low
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability was found in the Linux kernel's w83791d hardware monitoring driver. The FAN_FROM_REG macro evaluates its arguments multiple times, and when used in lockless contexts with shared driver data, a race condition can cause the divisor value to change between check and use, potentially leading to a divide-by-zero error.

Statement: This vulnerability affects systems with Winbond W83791D hardware monitoring chips. The race condition requires concurrent access to fan divisor settings, which is uncommon in typical usage scenarios. The divide-by-zero would cause a kernel crash (denial of service). Physical access to the monitoring hardware configuration is effectively required.

Remediation:
To mitigate this issue, prevent the w83791d module from being loaded if Winbond W83791D hardware monitoring is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.