huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
cgroup/cpuset: remove kernfs active break
CVE: CVE-2025-21634
Component: kernel
CWE: CWE-99
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-01-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cgroup/cpuset: remove kernfs active break

A warning was found:

WARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828
CPU: 10 PID: 3486953 Comm: rmdir Kdump: loaded Tainted: G
RIP: 0010:kernfs_should_drain_open_files+0x1a1/0x1b0
RSP: 0018:ffff8881107ef9e0 EFLAGS: 00010202
RAX: 0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000
RDX: 0000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04
RBP: ffff888154738c04 R08: ffffffffaf27fa15 R09: ffffed102a8e7180
R10: ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08
R13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0
FS:  00007f84cd0be740(0000) GS:ffff8887ddc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 kernfs_drain+0x15e/0x2f0
 __kernfs_remove+0x165/0x300
 kernfs_remove_by_name_ns+0x7b/0xc0
 cgroup_rm_file+0x154/0x1c0
 cgroup_addrm_files+0x1c2/0x1f0
 css_clear_dir+0x77/0x110
 kill_css+0x4c/0x1b0
 cgroup_destroy_locked+0x194/0x380
 cgroup_rmdir+0x2a/0x140

It can be explained by:
rmdir 				echo 1 > cpuset.cpus
				kernfs_fop_write_iter // active=0
cgroup_rm_file
kernfs_remove_by_name_ns	kernfs_get_active // active=1
__kernfs_remove					  // active=0x80000002
kernfs_drain			cpuset_write_resmask
wait_event
//waiting (active == 0x80000001)
				kernfs_break_active_protection
				// active = 0x80000001
// continue
				kernfs_unbreak_active_protection
				// active = 0x80000002
...
kernfs_should_drain_open_files
// warning occurs
				kernfs_put_active

This warning is caused by 'kernfs_break_active_protection' when it is
writing to cpuset.cpus, and the cgroup is removed concurrently.

The commit 3a5a6d0c2b03 ("cpuset: don't nest cgroup_mutex inside
get_online_cpus()") made cpuset_hotplug_workfn asynchronous, This change
involves calling flush_work(), which can create a multiple processes
circular locking dependency that involve cgroup_mutex, potentially leading
to a deadlock. To avoid deadlock. the commit 76bb5ab8f6e3 ("cpuset: break
kernfs active protection in cpuset_write_resmask()") added
'kernfs_break_active_protection' in the cpuset_write_resmask. This could
lead to this warning.

After the commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug
processing synchronous"), the cpuset_write_resmask no longer needs to
wait the hotplug to finish, which means that concurrent hotplug and cpuset
operations are no longer possible. Therefore, the deadlock doesn't exist
anymore and it does not have to 'break active protection' now. To fix this
warning, just remove kernfs_break_active_protection operation in the
'cpuset_write_resmask'.


Remediation:
perf/core: Fix system hang caused by cpu-clock usage
CVE: CVE-2025-40327
Component: kernel
Severity: Moderate
CVSS v3: 6.6/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
Release date: 2025-12-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Fix system hang caused by cpu-clock usage

cpu-clock usage by the async-profiler tool can trigger a system hang,
which got bisected back to the following commit by Octavia Togami:

  18dbcbfabfff ("perf: Fix the POLL_HUP delivery breakage") causes this issue

The root cause of the hang is that cpu-clock is a special type of SW
event which relies on hrtimers. The __perf_event_overflow() callback
is invoked from the hrtimer handler for cpu-clock events, and
__perf_event_overflow() tries to call cpu_clock_event_stop()
to stop the event, which calls htimer_cancel() to cancel the hrtimer.

But that's a recursion into the hrtimer code from a hrtimer handler,
which (unsurprisingly) deadlocks.

To fix this bug, use hrtimer_try_to_cancel() instead, and set
the PERF_HES_STOPPED flag, which causes perf_swevent_hrtimer()
to stop the event once it sees the PERF_HES_STOPPED flag.

[ mingo: Fixed the comments and improved the changelog. ]

Statement: This issue affects systems where local users can create perf cpu-clock events. The vulnerability requires local access and the ability to use the perf_event_open() system call, which may be restricted by the kernel.perf_event_paranoid sysctl setting. Exploitation leads to a system hang requiring a reboot to recover.

Remediation:
PostgreSQL executes arbitrary code in restore operation
CVE: CVE-2025-8715
Component: postgresql
CWE: CWE-93
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-08-14T13:00:07.753000+00:00

A flaw was found in PostgreSQL. This vulnerability allows a malicious user of the PostgreSQL server to inject arbitrary code in dump files created by pg_dump, pg_dumpall, pg_restore, and pg_upgrade, causing arbitrary code execution on the client machine or SQL injection when these dump files are restored by psql due to an improper neutralization of newlines.

Statement: To exploit this flaw, a malicious PostgreSQL user needs to inject arbitrary code or the SQL injection payload in a database object name. The malicious code will only be executed on the client machine when a user restore the crafted dump file. Due to these reasons, this vulnerability has been rated with an Important severity.

Remediation:
Do not restore a dump file from a server or user you do not explicitly trust.
cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate()
CVE: CVE-2025-37830
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate()

cpufreq_cpu_get_raw() can return NULL when the target CPU is not present
in the policy->cpus mask. scmi_cpufreq_get_rate() does not check for
this case, which results in a NULL pointer dereference.

Add NULL check after cpufreq_cpu_get_raw() to prevent this issue.


Remediation:
Use after free in USB
CVE: CVE-2025-3620
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-04-16T20:57:45.676000+00:00

Use after free in USB in Google Chrome prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Memory leak on soup_header_parse_quality_list() via soup-headers.c
CVE: CVE-2025-46420
Component: libsoup
CWE: CWE-401
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-04-24T00:00:00+00:00

A flaw was found in libsoup. It is vulnerable to memory leaks in the soup_header_parse_quality_list() function when parsing a quality list that contains elements with all zeroes.


Remediation:
Currently, no mitigation is available for this vulnerability.
Processing maliciously crafted web content may lead to an unexpected Safari crash
CVE: CVE-2025-43272
Component: webkitgtk
CWE: CWE-119
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-09-23T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.

Statement: To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.

Remediation:
Do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
wabt: Arbitrary code execution, information disclosure, and denial of service via out-of-bounds read
CVE: CVE-2025-15412
Component: wabt
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in wabt. A local user can exploit an out-of-bounds read vulnerability by manipulating the `wabt::Decompiler::VarName` function within the `wasm-decompile` component. This can lead to information disclosure, denial of service, and potentially arbitrary code execution.

Statement: This vulnerability is rated Moderate which exists in the `wasm-decompile` utility of the `wabt` package and requires local access to exploit. An attacker with local access could provide a specially crafted WebAssembly binary to the `wasm-decompile` tool, leading to an out-of-bounds read. This issue affects components like `wabt` in Fedora and `firefox`, `thunderbird` in Red Hat Enterprise Linux.

Remediation:
CVE: CVE-2025-7233
Component: IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Release date: 2025-07-08T19:56:41.424000+00:00

IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26072.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Buffer overflow during serialization of DollarBlend in font
CVE: CVE-2025-27830
Component: Ghostscript
CWE: CWE-120
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-03-25T00:00:00+00:00

A flaw was found in Artifex Ghostscript. A buffer overflow occurs during serialization of DollarBlend in a font, in base/write_t1.c and psi/zfapi.c.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
CVE: CVE-2025-38696
Component: kernel
Severity: None
Release date: 2025-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

MIPS: Don't crash in stack_top() for tasks without ABI or vDSO

Not all tasks have an ABI associated or vDSO mapped,
for example kthreads never do.
If such a task ever ends up calling stack_top(), it will derefence the
NULL ABI pointer and crash.

This can for example happen when using kunit:

    mips_stack_top+0x28/0xc0
    arch_pick_mmap_layout+0x190/0x220
    kunit_vm_mmap_init+0xf8/0x138
    __kunit_add_resource+0x40/0xa8
    kunit_vm_mmap+0x88/0xd8
    usercopy_test_init+0xb8/0x240
    kunit_try_run_case+0x5c/0x1a8
    kunit_generic_run_threadfn_adapter+0x28/0x50
    kthread+0x118/0x240
    ret_from_kernel_thread+0x14/0x1c

Only dereference the ABI point if it is set.

The GIC page is also included as it is specific to the vDSO.
Also move the randomization adjustment into the same conditional.


Remediation:
Linux kernel FUSE: Denial of Service via readahead reclaim deadlock
CVE: CVE-2025-68821
Component: kernel
CWE: CWE-833
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's Filesystem in Userspace (FUSE) subsystem. This vulnerability allows a local attacker to cause a system-wide deadlock. The flaw occurs due to incorrect handling of inode references during readahead operations when the FUSE server does not implement the `open` function. This can lead to a Denial of Service (DoS) as the system becomes unresponsive.


Remediation:
net: tun: Update napi->skb after XDP process
CVE: CVE-2025-39984
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 7.5/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Release date: 2025-10-15T00:00:00+00:00

A use-after-free flaw was found in tun_get_user in drivers/net/tun.c in  network TUNnel module in Linux kernel. This flaw could allow an attacker to crash the system at device disconnect. This vulnerability could even lead to a kernel information leak problem.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently
available options don't meet the Red Hat Product Security criteria
comprising ease of use and deployment, applicability to widespread
installation base or stability.
Integer Overflow in SQLite concat_ws Function
CVE: CVE-2025-29087
Component: sqlite
CWE: CWE-190
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-07T00:00:00+00:00

A flaw was found in SQLite. This vulnerability allows an attacker to cause an integer overflow via the concat_ws function.

Statement: The severity of this vulnerability is rated as Moderate, despite the potential for a severe outcome in unrestricted environments, primarily due to the limited impact observed within typical product deployments and the strong defense layers in regulated systems. The underlying flaw is a software error identified as CWE-190: Integer Overflow or Wraparound , which, when triggered, can corrupt memory and potentially lead to a complete compromise of system availability. However, a critical factor in the Moderate rating is that Red Hat’s product impact assessment determined that the vulnerability is limited to a Denial of Service (DoS) outcome, preventing Confidentiality or Integrity compromise. Furthermore, regulated environments introduce multiple significant barriers: process isolation ensures that any memory corruption is contained within the single affected process; least functionality reduces the initial attack surface; and layered memory protection mechanisms like Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) enhance system resilience against memory manipulation attacks. These controls collectively make successful exploitation difficult, contain the damage to a service crash, and justify the Moderate rating instead of the upstream High score.

RHEL/UBI 9 ships SQLite version 3.34.1, which is not affected by this CVE.This vulnerability only exists in SQLite versions 3.44.0 through 3.49.0.

Red Hat evaluated the vulnerability according to our standard product impact assessment criteria and determined that the issue does not meet the threshold for a High severity rating. Although the upstream advisory scored the issue as High based on potential impact, exploitation requires specific conditions and is limited in scope within Red Hat products. Even if triggered, the vulnerability is limited to a denial-of-service outcome rather than remote code execution or compromise of confidentiality or integrity. For this reason, Red Hat assigned a Moderate severity rating.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability
CVE: CVE-2025-11001
Component: 7zip
CVSS v3: 6.9/CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-11-19T21:16:49.635000+00:00

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. Interaction with this product is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the handling of symbolic links in ZIP files. Crafted data in a ZIP file can cause the process to traverse to unintended directories. An attacker can leverage this vulnerability to execute code in the context of a service account. Was ZDI-CAN-26753.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
media: venus: Fix OOB read due to missing payload bound check
CVE: CVE-2025-38679
Component: kernel
Severity: None
Release date: 2025-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: venus: Fix OOB read due to missing payload bound check

Currently, The event_seq_changed() handler processes a variable number
of properties sent by the firmware. The number of properties is indicated
by the firmware and used to iterate over the payload. However, the
payload size is not being validated against the actual message length.

This can lead to out-of-bounds memory access if the firmware provides a
property count that exceeds the data available in the payload. Such a
condition can result in kernel crashes or potential information leaks if
memory beyond the buffer is accessed.

Fix this by properly validating the remaining size of the payload before
each property access and updating bounds accordingly as properties are
parsed.

This ensures that property parsing is safely bounded within the received
message buffer and protects against malformed or malicious firmware
behavior.


Remediation:
Inappropriate implementation in Picture In Picture in Google Chrome
CVE: CVE-2025-8579
Component: chromium-browser
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-08-07T01:30:39.240000+00:00

Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
aiohttp: Information disclosure of path components via static file path normalization
CVE: CVE-2025-69226
Component: aiohttp
CWE: CWE-22
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in aiohttp, an asynchronous HTTP client/server framework for Python. An attacker can exploit a vulnerability in the path normalization logic for static files to determine if specific absolute path components exist on the server. This information disclosure is possible if the application uses web.static().

Statement: This vulnerability is rated Moderate for Red Hat products. It allows for information disclosure of path components if an application uses aiohttp's web.static() function. Red Hat generally advises against using web.static() for serving static files in production environments, which limits the impact in typical deployments.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
Linux kernel: Denial of Service due to data race in vmalloc's show_numa_info function
CVE: CVE-2025-38383
Component: kernel
CWE: CWE-820
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-07-25T00:00:00+00:00

A flaw was found in the Linux kernel. A data race vulnerability exists in the `show_numa_info()` function within the `mm/vmalloc` component. This occurs because the `m->private` memory is accessible to multiple central processing units (CPUs) simultaneously, leading to inconsistent data reads and writes. A local attacker could exploit this to cause a system crash or other unpredictable behavior, resulting in a Denial of Service (DoS).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Vuetify Prototype Pollution via Preset options
CVE: CVE-2025-8083
Component: vuetify
CVSS v3: 7.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-12-12T19:29:06.926000+00:00

The  Preset configuration https://v2.vuetifyjs.com/en/features/presets  feature of Vuetify is vulnerable to  Prototype Pollution https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html  due to the internal 'mergeDeep' utility function used to merge options with defaults. Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can further negatively affect all aspects of the application's behavior. This can lead to a wide range of security issues, including resource exhaustion/denial of service or unauthorized access to data.

If the application utilizes Server-Side Rendering (SSR), this vulnerability could affect the whole server process.

This issue affects Vuetify versions greater than or equal to 2.2.0-beta.2 and less than 3.0.0-alpha.10.

Note:
Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see  here https://v2.vuetifyjs.com/en/about/eol/ .

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.