huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup
CVE: CVE-2026-23041
Component: kernel
Severity: Moderate
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup

When bnxt_init_one() fails during initialization (e.g.,
bnxt_init_int_mode returns -ENODEV), the error path calls
bnxt_free_hwrm_resources() which destroys the DMA pool and sets
bp->hwrm_dma_pool to NULL. Subsequently, bnxt_ptp_clear() is called,
which invokes ptp_clock_unregister().

Since commit a60fc3294a37 ("ptp: rework ptp_clock_unregister() to
disable events"), ptp_clock_unregister() now calls
ptp_disable_all_events(), which in turn invokes the driver's .enable()
callback (bnxt_ptp_enable()) to disable PTP events before completing the
unregistration.

bnxt_ptp_enable() attempts to send HWRM commands via bnxt_ptp_cfg_pin()
and bnxt_ptp_cfg_event(), both of which call hwrm_req_init(). This
function tries to allocate from bp->hwrm_dma_pool, causing a NULL
pointer dereference:

  bnxt_en 0000:01:00.0 (unnamed net_device) (uninitialized): bnxt_init_int_mode err: ffffffed
  KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
  Call Trace:
   __hwrm_req_init (drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c:72)
   bnxt_ptp_enable (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:323 drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:517)
   ptp_disable_all_events (drivers/ptp/ptp_chardev.c:66)
   ptp_clock_unregister (drivers/ptp/ptp_clock.c:518)
   bnxt_ptp_clear (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:1134)
   bnxt_init_one (drivers/net/ethernet/broadcom/bnxt/bnxt.c:16889)

Lines are against commit f8f9c1f4d0c7 ("Linux 6.19-rc3")

Fix this by clearing and unregistering ptp (bnxt_ptp_clear()) before
freeing HWRM resources.


Remediation:
Svelte: Cross-Site Scripting and HTML injection via improper escaping of bind:innerText and bind:textContent
CVE: CVE-2026-27901
Component: svelte
CWE: CWE-79
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2026-02-26T00:57:40.269000+00:00

A flaw was found in svelte, a performance-oriented web framework. When rendering untrusted data as the initial value for `bind:innerText` and `bind:textContent` on `contenteditable` elements on the server, the contents were not properly escaped. This improper handling could allow a remote attacker to perform HTML injection and Cross-Site Scripting (XSS), leading to the execution of malicious scripts in the user's browser.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Gitea Release Email Notifications Leak Private Repository Release Details After Access Revocation
CVE: CVE-2026-0798
Component: gitea
CWE: CWE-497
Severity: Low
CVSS v3: 3.7/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Release date: 2026-01-22T22:01:49.410000+00:00

Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags, and content.


Remediation:
CVE: CVE-2026-0777
Component: Xmind Attachment Insufficient UI Warning Remote Code Execution Vulnerability
Release date: 2026-02-13T21:40:50.560000+00:00

Xmind Attachment Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xmind. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of attachments. When opening an attachment, the user interface fails to warn the user of unsafe actions. An attacker can leverage this vulnerability to execute code in the context of current user. Was ZDI-CAN-26034.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
libsoup: HTTP header injection or response splitting via CRLF injection in Content-Disposition header
CVE: CVE-2026-1536
Component: libsoup
CWE: CWE-93
Severity: Moderate
CVSS v3: 5.7/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Release date: 2026-01-28T00:00:00+00:00

A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) sequences into the header value. These sequences are then interpreted verbatim when the HTTP request or response is constructed, allowing arbitrary HTTP headers to be injected. This vulnerability can lead to HTTP header injection or HTTP response splitting without requiring authentication or user interaction.

Statement: This is a MODERATE impact flaw in the libsoup HTTP library, allowing CRLF injection via the `soup_message_headers_set_content_disposition()` function. An attacker controlling input to the `Content-Disposition` header can inject arbitrary HTTP headers. Red Hat products are affected if they use libsoup in a configuration that passes unsanitized, untrusted input to this function.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
ice: fix devlink reload call trace
CVE: CVE-2026-23104
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A use-after-free vulnerability was found in the Intel ice network driver in the Linux kernel. When devlink reload is used followed by driver removal, the hwmon sysfs attributes are left orphaned with dangling pointers to freed module memory. System monitoring tools like sadc that periodically read hwmon attributes trigger page faults when accessing the freed memory, causing recurring kernel crashes approximately every 10 minutes.

Statement: This vulnerability affects systems with Intel Ice Lake network adapters that use devlink reload functionality. The issue manifests after driver unload when monitoring tools access orphaned hwmon sysfs files. While exploitation requires administrative devlink operations, the resulting periodic crashes significantly impact system stability.

Remediation:
LangGraph Checkpoint: Remote Code Execution via insecure deserialization in caching layer
CVE: CVE-2026-27794
Component: langgraph-checkpoint
CWE: CWE-502
Severity: Moderate
CVSS v3: 7.2/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-25T16:53:47.176000+00:00

A flaw was found in LangGraph Checkpoint. This vulnerability allows a remote attacker with write access to the cache backend to achieve remote code execution. This occurs when applications enable cache backends that inherit from `BaseCache` and opt nodes into caching via `CachePolicy`. If `msgpack` serialization fails, cached values can be deserialized using `pickle.loads(...)`, leading to the execution of arbitrary code. Exploitation requires prior write access to the cache storage layer, making it a post-compromise escalation vector.

Statement: As noted above, caching is not enabled by default, and this vulnerability only affects applications which have enabled a cache backend.

Remediation:
CVE: CVE-2026-2033
Component: MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability
Release date: 2026-02-13T14:14:37.649000+00:00

MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of artifact file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26649.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
unauthenticated API exposure
CVE: CVE-2026-32596
Component: glances
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-18T05:18:11.547000+00:00

No description is available for this CVE.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
embedded /httpstatus page echos user supplied values without sanitization
CVE: CVE-2026-23738
Component: asterisk
CVSS v3: 4.6/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2026-02-06T16:41:43.769000+00:00

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/control values for Cookies and any GET variable query Parameter are directly interpolated into the HTML of the page using ast_str_append. The endpoint at GET /httpstatus is the potential vulnerable endpoint relating to asterisk/main /http.c. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
AWS-LC: Information disclosure via timing discrepancy in AES-CCM decryption
CVE: CVE-2026-3337
Component: aws-lc
CWE: CWE-208
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Release date: 2026-03-02T21:20:08.532000+00:00

A flaw was found in AWS-LC. This vulnerability, a timing discrepancy, allows an unauthenticated attacker to potentially determine the validity of an authentication tag. This information disclosure could be exploited through timing analysis.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
nfsd: provide locking for v4_end_grace
CVE: CVE-2026-22980
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nfsd: provide locking for v4_end_grace

Writing to v4_end_grace can race with server shutdown and result in
memory being accessed after it was freed - reclaim_str_hashtbl in
particularly.

We cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is
held while client_tracking_op->init() is called and that can wait for
an upcall to nfsdcltrack which can write to v4_end_grace, resulting in a
deadlock.

nfsd4_end_grace() is also called by the landromat work queue and this
doesn't require locking as server shutdown will stop the work and wait
for it before freeing anything that nfsd4_end_grace() might access.

However, we must be sure that writing to v4_end_grace doesn't restart
the work item after shutdown has already waited for it.  For this we
add a new flag protected with nn->client_lock.  It is set only while it
is safe to make client tracking calls, and v4_end_grace only schedules
work while the flag is set with the spinlock held.

So this patch adds a nfsd_net field "client_tracking_active" which is
set as described.  Another field "grace_end_forced", is set when
v4_end_grace is written.  After this is set, and providing
client_tracking_active is set, the laundromat is scheduled.
This "grace_end_forced" field bypasses other checks for whether the
grace period has finished.

This resolves a race which can result in use-after-free.

Statement: A race in the NFSv4 admin “end grace” control can lead to a use-after-free when a write to v4_end_grace overlaps with server shutdown, causing freed state (e.g., reclaim tracking tables) to be accessed. The trigger is local via an administrative interface (typically requiring root-equivalent privileges), and the impact is a kernel crash.

Remediation:
Heap off-by-one in KVM Xen PHYSDEVOP_map_pirq
CVE: CVE-2026-0665
Component: qemu-kvm
CWE: CWE-787
Severity: Moderate
CVSS v3: 6.3/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Release date: 2026-01-09T00:00:00+00:00

An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to trigger out-of-bounds heap accesses in the QEMU process via the emulated Xen physdev hypercall interface, leading to a denial of service or potential memory corruption.

Statement: Xen guest support is disabled at build time in the `qemu-kvm` packages as shipped with Red Hat Enterprise Linux. Consequently, RHEL is not affected by this CVE.

Remediation:
alsa-lib Topology Decoder Heap-based Buffer Overflow
CVE: CVE-2026-25068
Component: alsa-lib
CWE: CWE-787
Severity: Moderate
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-01-29T19:08:03.986000+00:00

alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
FreeRDP has a heap-buffer-overflow in urb_select_interface
CVE: CVE-2026-24679
Component: freerdp
CWE: CWE-1285
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-09T18:19:00.409000+00:00

A heap buffer overflow has been discovered in FreeRDP. The URBDRC client uses server-supplied interface numbers as array indices without bounds checks, causing an out-of-bounds read in libusb_udev_select_interface.

Statement: Availability impact is limited to the FreeRDP instance on Red Hat Products. General system availability is not at risk.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Fastify: Bypass of Content-Type validation via malformed Content-Type headers
CVE: CVE-2026-3419
Component: fastify
CWE: CWE-625
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2026-03-06T17:50:58.714000+00:00

Fastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in violation of RFC 9110 §8.3.1(https://httpwg.org/specs/rfc9110.html#field.content-type). For example, a request sent with Content-Type: application/json garbage passes validation and is processed normally, rather than being rejected with 415 Unsupported Media Type.

When regex-based content-type parsers are in use (a documented Fastify feature), the malformed value is matched against registered parsers using the full string including the trailing garbage. This means a request with an invalid content-type may be routed to and processed by a parser it should never have reached.

Impact:
An attacker can send requests with RFC-invalid Content-Type headers that bypass validity checks, reach content-type parser matching, and be processed by the server. Requests that should be rejected at the validation stage are instead handled as if the content-type were valid.

Workarounds:
Deploy a WAF rule to protect against this

Fix:

The fix is available starting with v5.8.1.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Linux kernel: Denial of Service due to improper network connection tracking reference handling
CVE: CVE-2026-23016
Component: kernel
CWE: CWE-911
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Release date: 2026-01-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

inet: frags: drop fraglist conntrack references

Jakub added a warning in nf_conntrack_cleanup_net_list() to make debugging
leaked skbs/conntrack references more obvious.

syzbot reports this as triggering, and I can also reproduce this via
ip_defrag.sh selftest:

 conntrack cleanup blocked for 60s
 WARNING: net/netfilter/nf_conntrack_core.c:2512
 [..]

conntrack clenups gets stuck because there are skbs with still hold nf_conn
references via their frag_list.

   net.core.skb_defer_max=0 makes the hang disappear.

Eric Dumazet points out that skb_release_head_state() doesn't follow the
fraglist.

ip_defrag.sh can only reproduce this problem since
commit 6471658dc66c ("udp: use skb_attempt_defer_free()"), but AFAICS this
problem could happen with TCP as well if pmtu discovery is off.

The relevant problem path for udp is:
1. netns emits fragmented packets
2. nf_defrag_v6_hook reassembles them (in output hook)
3. reassembled skb is tracked (skb owns nf_conn reference)
4. ip6_output refragments
5. refragmented packets also own nf_conn reference (ip6_fragment
   calls ip6_copy_metadata())
6. on input path, nf_defrag_v6_hook skips defragmentation: the
   fragments already have skb->nf_conn attached
7. skbs are reassembled via ipv6_frag_rcv()
8. skb_consume_udp -> skb_attempt_defer_free() -> skb ends up
   in pcpu freelist, but still has nf_conn reference.

Possible solutions:
 1 let defrag engine drop nf_conn entry, OR
 2 export kick_defer_list_purge() and call it from the conntrack
   netns exit callback, OR
 3 add skb_has_frag_list() check to skb_attempt_defer_free()

2 & 3 also solve ip_defrag.sh hang but share same drawback:

Such reassembled skbs, queued to socket, can prevent conntrack module
removal until userspace has consumed the packet. While both tcp and udp
stack do call nf_reset_ct() before placing skb on socket queue, that
function doesn't iterate frag_list skbs.

Therefore drop nf_conn entries when they are placed in defrag queue.
Keep the nf_conn entry of the first (offset 0) skb so that reassembled
skb retains nf_conn entry for sake of TX path.

Note that fixes tag is incorrect; it points to the commit introducing the
'ip_defrag.sh reproducible problem': no need to backport this patch to
every stable kernel.


Remediation:
firewire: core: fix race condition against transaction list
CVE: CVE-2026-23153
Component: kernel
CWE: CWE-366
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

firewire: core: fix race condition against transaction list

The list of transaction is enumerated without acquiring card lock when
processing AR response event. This causes a race condition bug when
processing AT request completion event concurrently.

This commit fixes the bug by put timer start for split transaction
expiration into the scope of lock. The value of jiffies in card structure
is referred before acquiring the lock.


Remediation:
micropython runtime.c mp_import_all memory corruption
CVE: CVE-2026-1998
Component: micropython
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-06T06:02:08.671000+00:00

A flaw has been found in micropython up to 1.27.0. This vulnerability affects the function mp_import_all of the file py/runtime.c. This manipulation causes memory corruption. The attack needs to be launched locally. The exploit has been published and may be used. Patch name: 570744d06c5ba9dba59b4c3f432ca4f0abd396b6. It is suggested to install a patch to address this issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Apache Arrow C++: Denial of Service via Use After Free vulnerability when reading IPC files
CVE: CVE-2026-25087
Component: apache-arrow
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.2/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-02-17T13:18:25.494000+00:00

Use After Free vulnerability in Apache Arrow C++.

This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shared_ptr<Buffer>` object) that is written to the dangling pointer is not under direct control of the attacker.

Pre-buffering is disabled by default but can be enabled using a specific C++ API call (`RecordBatchFileReader::PreBufferMetadata`). The functionality is not exposed in language bindings (Python, Ruby, C GLib), so these bindings are not vulnerable.

The most likely consequence of this issue would be random crashes or memory corruption when reading specific kinds of IPC files. If the application allows ingesting IPC files from untrusted sources, this could plausibly be exploited for denial of service. Inducing more targeted kinds of misbehavior (such as confidential data extraction from the running process) depends on memory allocation and multi-threaded IO temporal patterns that are unlikely to be easily controlled by an attacker.

Advice for users of Arrow C++:

1. check whether you enable pre-buffering on the IPC file reader (using `RecordBatchFileReader::PreBufferMetadata`)

2. if so, either disable pre-buffering (which may have adverse performance consequences), or switch to Arrow 23.0.1 which is not vulnerable


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.