huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
media: usbtv: Lock resolution while streaming
CVE: CVE-2025-39714
Component: kernel
Severity: None
Release date: 2025-09-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: usbtv: Lock resolution while streaming

When an program is streaming (ffplay) and another program (qv4l2)
changes the TV standard from NTSC to PAL, the kernel crashes due to trying
to copy to unmapped memory.

Changing from NTSC to PAL increases the resolution in the usbtv struct,
but the video plane buffer isn't adjusted, so it overflows.

[hverkuil: call vb2_is_busy instead of vb2_is_streaming]


Remediation:
Incorrect security UI in Fullscreen UI
CVE: CVE-2025-12444
Component: chromium-browser
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-11-10T20:00:21.687000+00:00

Incorrect security UI in Fullscreen UI in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Linux kernel: Denial of Service in ACPICA due to missing method arguments
CVE: CVE-2025-38386
Component: kernel
CWE: CWE-628
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ACPICA: Refuse to evaluate a method if arguments are missing

As reported in [1], a platform firmware update that increased the number
of method parameters and forgot to update a least one of its callers,
caused ACPICA to crash due to use-after-free.

Since this a result of a clear AML issue that arguably cannot be fixed
up by the interpreter (it cannot produce missing data out of thin air),
address it by making ACPICA refuse to evaluate a method if the caller
attempts to pass fewer arguments than expected to it.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo
CVE: CVE-2025-37970
Component: kernel
Severity: None
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo

Prevent st_lsm6dsx_read_fifo from falling in an infinite loop in case
pattern_len is equal to zero and the device FIFO is not empty.


Remediation:
vLLM phi4mm: Quadratic Time Complexity in Input Token Processing​ leads to denial of service
CVE: CVE-2025-46560
Component: vllm
CWE: CWE-1333
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-30T00:24:53.750000+00:00

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.8.0 and prior to 0.8.5 are affected by a critical performance vulnerability in the input preprocessing logic of the multimodal tokenizer. The code dynamically replaces placeholder tokens (e.g., 
, 
) with repeated tokens based on precomputed lengths. Due to ​​inefficient list concatenation operations​​, the algorithm exhibits ​​quadratic time complexity (O(n²))​​, allowing malicious actors to trigger resource exhaustion via specially crafted inputs. This issue has been patched in version 0.8.5.

Statement: Red Hat products are not using any affected version of the vllm component.  Hence, Red Hat products are not affected by this vulnerability.

Remediation:
To mitigate this vulnerability:
- Precompute all placeholder positions and expansion lengths upfront.
- Replace dynamic list concatenation with a single preallocated array.
Improper Input Validation in Vim
CVE: CVE-2025-27423
Component: vim
CWE: CWE-77
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Release date: 2025-03-03T16:30:19.752000+00:00

A flaw was found in the tar.vim plugin of Vim. This vulnerability allows arbitrary command execution via specially crafted tar archives that exploit the unsanitized :read ex command.

Statement: Red Hat believes this vulnerability to be of moderate impact due to the fact that successful execution requires both the shell-specific conditions as well as manual interaction on the part of the victim to open and interact with a specially-crafted tar file in vim.

Remediation:
User DoS and Name Disclosure via IDOR in Moodle MFA Email Factor Revoke Action
CVE: CVE-2025-3625
Component: moodle
CVSS v3: 7.3/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Release date: 2025-04-22T12:00:00+00:00

A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had completed two-factor authentication (2FA).

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
LibYAML Perl File Modification Vulnerability
CVE: CVE-2025-40908
Component: yaml-libyaml
CWE: CWE-552
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2025-06-01T13:41:48.168000+00:00

A flaw was found in yaml-libyaml. The component uses a two-argument `open` function when parsing YAML files, which allows an attacker to modify existing files on the system. This flaw allows a local attacker to provide a crafted YAML file as input. This issue can result in unauthorized modification of files.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
smb: client: Fix netns refcount imbalance causing leaks and use-after-free
CVE: CVE-2025-37835
Component: kernel
Severity: None
Release date: 2025-05-09T00:00:00+00:00

[REJECTED CVE] In the Linux kernel, the following vulnerability has been resolved:
smb: client: Fix netns refcount imbalance causing leaks and use-after-free

Statement: This CVE has been rejected by the Linux kernel community. Refer to the announcement: https://lore.kernel.org/linux-cve-announce/2025051013-REJECTED-57fc@gregkh/

Remediation:
connect-src Content Security Policy restriction could be bypassed
CVE: CVE-2025-6427
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-06-24T12:28:01.317000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: An attacker is able to bypass the <code>connect-src</code> directive of a Content Security Policy by manipulating subdocuments. This also hides the connections from the Network tab in Devtools.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Buffer overflow when converting glyphs to unicode
CVE: CVE-2025-27835
Component: Ghostscript
CWE: CWE-120
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-03-25T00:00:00+00:00

A flaw was found in Artifex Ghostscript. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Information disclosure via world-readable VM snapshots
CVE: CVE-2025-13193
Component: libvirt
CWE: CWE-276
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-11-12T00:00:00+00:00

A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Optimizer unspecified vulnerability (CPU Jan 2025)
CVE: CVE-2025-21518
Component: mysql
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-21T20:53:03.419000+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and  9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).


Remediation:
CVE: CVE-2025-7236
Component: IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability
Release date: 2025-07-08T19:56:23.393000+00:00

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26080.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using
CVE: CVE-2025-38369
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using

Running IDXD workloads in a container with the /dev directory mounted can
trigger a call trace or even a kernel panic when the parent process of the
container is terminated.

This issue occurs because, under certain configurations, Docker does not
properly propagate the mount replica back to the original mount point.

In this case, when the user driver detaches, the WQ is destroyed but it
still calls destroy_workqueue() attempting to completes all pending work.
It's necessary to check wq->wq and skip the drain if it no longer exists.

Statement: This vulnerability in the Intel IDXD DMA engine driver results from a missing check before draining a potentially destroyed workqueue object. When running workloads in containers with /dev mounted, the driver may attempt to call `drain_workqueue()` on a NULL pointer after the parent process exits, leading to a kernel panic.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Bluetooth: MGMT: Fix possible UAFs
CVE: CVE-2025-39981
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.5/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Release date: 2025-10-15T00:00:00+00:00

A flaw was found in the Linux kernel’s Bluetooth management subsystem (net/bluetooth/mgmt*.c). The mgmt_pending structure may be freed while still being processed, or remain on the pending command list, which allows a use-after-free or double-free scenario. An attacker with local access to the system and the ability to interact with the Bluetooth subsystem could exploit this to trigger memory corruption, potentially leading to elevated privileges or denial of service.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Ensure Bluetooth management interfaces are hardened or, if unused, disabled.
media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
CVE: CVE-2025-38693
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar

In w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add
check on msg[0].len to prevent crash.

Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")


Remediation:
drm/amdgpu: validate userq buffer virtual address and size
CVE: CVE-2025-40334
Component: kernel
CWE: CWE-1285
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-09T00:00:00+00:00

An input validation vulnerability was found in the AMD GPU driver in the Linux kernel. The user queue (userq) buffer virtual address and size are not properly validated to ensure they reside within a valid VM mapping. This could allow a local user to provide invalid addresses, potentially causing memory corruption or system crashes.

Statement: This is an input validation issue in the AMD GPU driver's user queue handling. The impact requires local access with GPU access permissions and affects systems with AMD graphics hardware.

Remediation:
To mitigate this issue, prevent the amdgpu module from being loaded. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.
ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header
CVE: CVE-2025-57808
Component: esphome
CVSS v3: 8.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2025-09-02T00:26:09.017000+00:00

A vulnerability has been identified in ESPHome’s web_server component on the ESP-IDF platform where the HTTP basic authentication check (AsyncWebServerRequest::authenticate) can be bypassed. Due to incorrect comparison of the base64-encoded Authorization header value, authentication succeeds if the client provides either an empty string or a substring of the correct user:password credential. As a result, an attacker on the adjacent network can gain unauthorized access to web_server functionality — including over-the-air (OTA) firmware updates if enabled — without knowing valid credentials.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Until a fix is applied, users should disable the web_server component on ESP-IDF devices, especially when OTA updates are enabled. Where disabling is not feasible, ensure devices are isolated from untrusted networks (e.g., place behind a firewall, restrict local access, or use VPN). Users are strongly advised not to expose the vulnerable web_server to the internet or untrusted clients until proper authentication handling is patched.
wifi: ath6kl: remove WARN on bad firmware input
CVE: CVE-2025-38406
Component: kernel
Severity: None
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath6kl: remove WARN on bad firmware input

If the firmware gives bad input, that's nothing to do with
the driver's stack at this point etc., so the WARN_ON()
doesn't add any value. Additionally, this is one of the
top syzbot reports now. Just print a message, and as an
added bonus, print the sizes too.


Remediation:
Linux kernel: Use-after-free in ASoC SOF Intel HDA driver allows information disclosure, privilege escalation, or denial of service
CVE: CVE-2025-38056
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: Intel: hda: Fix UAF when reloading module

hda_generic_machine_select() appends -idisp to the tplg filename by
allocating a new string with devm_kasprintf(), then stores the string
right back into the global variable snd_soc_acpi_intel_hda_machines.
When the module is unloaded, this memory is freed, resulting in a global
variable pointing to freed memory.  Reloading the module then triggers
a use-after-free:

BUG: KFENCE: use-after-free read in string+0x48/0xe0

Use-after-free read at 0x00000000967e0109 (in kfence-#99):
 string+0x48/0xe0
 vsnprintf+0x329/0x6e0
 devm_kvasprintf+0x54/0xb0
 devm_kasprintf+0x58/0x80
 hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
 sof_probe_work+0x7f/0x600 [snd_sof]
 process_one_work+0x17b/0x330
 worker_thread+0x2ce/0x3f0
 kthread+0xcf/0x100
 ret_from_fork+0x31/0x50
 ret_from_fork_asm+0x1a/0x30

kfence-#99: 0x00000000198a940f-0x00000000ace47d9d, size=64, cache=kmalloc-64

allocated by task 333 on cpu 8 at 17.798069s (130.453553s ago):
 devm_kmalloc+0x52/0x120
 devm_kvasprintf+0x66/0xb0
 devm_kasprintf+0x58/0x80
 hda_machine_select.cold+0x198/0x17a2 [snd_sof_intel_hda_generic]
 sof_probe_work+0x7f/0x600 [snd_sof]
 process_one_work+0x17b/0x330
 worker_thread+0x2ce/0x3f0
 kthread+0xcf/0x100
 ret_from_fork+0x31/0x50
 ret_from_fork_asm+0x1a/0x30

freed by task 1543 on cpu 4 at 141.586686s (6.665010s ago):
 release_nodes+0x43/0xb0
 devres_release_all+0x90/0xf0
 device_unbind_cleanup+0xe/0x70
 device_release_driver_internal+0x1c1/0x200
 driver_detach+0x48/0x90
 bus_remove_driver+0x6d/0xf0
 pci_unregister_driver+0x42/0xb0
 __do_sys_delete_module+0x1d1/0x310
 do_syscall_64+0x82/0x190
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Fix it by copying the match array with devm_kmemdup_array() before we
modify it.


Remediation:
To mitigate this issue, prevent the `snd_sof_intel_hda_generic` kernel module from loading. This can be achieved by blacklisting the module.\n1. Create a file `/etc/modprobe.d/blacklist-snd_sof_intel_hda_generic.conf` with the following content:\n   ```\n   blacklist snd_sof_intel_hda_generic\n   ```\n2. Regenerate the initramfs:\n   ```bash\n   dracut -f -v\n   ```\n3. Reboot the system for the changes to take effect.\nThis mitigation may impact audio functionality if the `snd_sof_intel_hda_generic` module is required for sound hardware. A system reboot is required for the changes to take effect.
phy: qcom-qusb2: Fix NULL pointer dereference on early suspend
CVE: CVE-2025-71193
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

phy: qcom-qusb2: Fix NULL pointer dereference on early suspend

Enabling runtime PM before attaching the QPHY instance as driver data
can lead to a NULL pointer dereference in runtime PM callbacks that
expect valid driver data. There is a small window where the suspend
callback may run after PM runtime enabling and before runtime forbid.
This causes a sporadic crash during boot:

```
Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a1
[...]
CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.16.7+ #116 PREEMPT
Workqueue: pm pm_runtime_work
pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : qusb2_phy_runtime_suspend+0x14/0x1e0 [phy_qcom_qusb2]
lr : pm_generic_runtime_suspend+0x2c/0x44
[...]
```

Attach the QPHY instance as driver data before enabling runtime PM to
prevent NULL pointer dereference in runtime PM callbacks.

Reorder pm_runtime_enable() and pm_runtime_forbid() to prevent a
short window where an unnecessary runtime suspend can occur.

Use the devres-managed version to ensure PM runtime is symmetrically
disabled during driver removal for proper cleanup.

Statement: A race condition in the Qualcomm QUSB2 PHY driver can trigger a NULL pointer dereference in runtime PM callbacks during early boot or suspend. The probe path enabled runtime PM before attaching the QPHY instance via dev_set_drvdata. There is a small timing window where pm runtime work can invoke qusb2_phy_runtime_suspend while driver data is still unset. In that case the callback dereferences a NULL pointer and the kernel crashes. The issue is sporadic and depends on scheduling and timing. It has been observed as a boot time crash in the pm_runtime_work context. For the CVSS the PR is N because the crash can occur during normal driver initialization without any explicit user interaction. In practice, reliably triggering the window may be easier with local control over runtime PM state via sysfs or device activity. The impact is availability only because the fault leads to a kernel panic and system reboot.

Remediation:
Technitium DNS Server: Denial of Service via rate-limiting component
CVE: CVE-2025-50334
Component: technitium-dns-server
CWE: CWE-770
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

An issue in Technitium DNS Server v.13.5 allows a remote attacker to cause a denial of service via the rate-limiting component


Remediation:
Denial of service on libsoup through HTTP/2 server
CVE: CVE-2025-32908
Component: libsoup
CWE: CWE-115
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-14T00:00:00+00:00

A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS).


Remediation:
Currently, no mitigation was found for this vulnerability.