huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link()
CVE: CVE-2025-68182
Component: kernel
CWE: CWE-364
Severity: Important
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-16T00:00:00+00:00

A use-after-free was found in the Intel iwlwifi driver in the Linux kernel. The iwl_mld_remove_link() function frees a link structure via kfree_rcu() but then dereferences it to read fw_id. Since RCU freeing is asynchronous, this creates a potential use-after-free window.

Statement: Intel WiFi adapters using the iwlwifi driver are affected. The race window is small since kfree_rcu deferral provides some protection, but the code is nonetheless incorrect and could cause issues under memory pressure.

Remediation:
To mitigate this issue, prevent the iwlwifi module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.
CVE: CVE-2025-9327
Component: Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Release date: 2025-08-21T20:11:46.217000+00:00

Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26774.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
DDL unspecified vulnerability (CPU Jul 2025)
CVE: CVE-2025-50104
Component: mysql
Severity: Low
CVSS v3: 3.7/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-07-15T19:27:51.097000+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).


Remediation:
CVE: CVE-2025-2838
Component: Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability
Release date: 2025-01-01T00:00:00+00:00

Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the processing of DNS responses. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23392.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
mod_proxy_http2: untrusted input from a client causes an assertion to fail in the Apache mod_proxy_http2 module
CVE: CVE-2025-49630
Component: httpd
CWE: CWE-617
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-14T07:22:15.866000+00:00

An assertion failure flaw was found in Apache httpd. Untrusted clients can send inputs that trigger an assertion failure in the mod_proxy_http2 module, which likely results in an Apache HTTP server crash or denial of service (DoS).

Statement: The vulnerability only affects Appache httpd if a reverse proxy is configured for an HTTP/2 backend, with the ProxyPreserveHost set to \"on\".

This vulnerability is rated as Moderate because it requires a highly specific and non-default configuration to be exploitable—namely, an Apache HTTP Server acting as a reverse proxy with an HTTP/2 backend and ProxyPreserveHost set to "on". The flaw results in an assertion failure in the mod_proxy_http2 module when handling specially crafted inputs from untrusted clients. While this can lead to a denial of service via server crash, the impact is limited to availability, with no risk of remote code execution or data leakage. Additionally, the condition is recoverable through a simple restart, and there is no persistent state corruption.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link. You must be logged in to download the update.
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
net: ravb: Fix missing rtnl lock in suspend/resume path
CVE: CVE-2025-21801
Component: kernel
Severity: None
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: ravb: Fix missing rtnl lock in suspend/resume path

Fix the suspend/resume path by ensuring the rtnl lock is held where
required. Calls to ravb_open, ravb_close and wol operations must be
performed under the rtnl lock to prevent conflicts with ongoing ndo
operations.

Without this fix, the following warning is triggered:
[   39.032969] =============================
[   39.032983] WARNING: suspicious RCU usage
[   39.033019] -----------------------------
[   39.033033] drivers/net/phy/phy_device.c:2004 suspicious
rcu_dereference_protected() usage!
...
[   39.033597] stack backtrace:
[   39.033613] CPU: 0 UID: 0 PID: 174 Comm: python3 Not tainted
6.13.0-rc7-next-20250116-arm64-renesas-00002-g35245dfdc62c #7
[   39.033623] Hardware name: Renesas SMARC EVK version 2 based on
r9a08g045s33 (DT)
[   39.033628] Call trace:
[   39.033633]  show_stack+0x14/0x1c (C)
[   39.033652]  dump_stack_lvl+0xb4/0xc4
[   39.033664]  dump_stack+0x14/0x1c
[   39.033671]  lockdep_rcu_suspicious+0x16c/0x22c
[   39.033682]  phy_detach+0x160/0x190
[   39.033694]  phy_disconnect+0x40/0x54
[   39.033703]  ravb_close+0x6c/0x1cc
[   39.033714]  ravb_suspend+0x48/0x120
[   39.033721]  dpm_run_callback+0x4c/0x14c
[   39.033731]  device_suspend+0x11c/0x4dc
[   39.033740]  dpm_suspend+0xdc/0x214
[   39.033748]  dpm_suspend_start+0x48/0x60
[   39.033758]  suspend_devices_and_enter+0x124/0x574
[   39.033769]  pm_suspend+0x1ac/0x274
[   39.033778]  state_store+0x88/0x124
[   39.033788]  kobj_attr_store+0x14/0x24
[   39.033798]  sysfs_kf_write+0x48/0x6c
[   39.033808]  kernfs_fop_write_iter+0x118/0x1a8
[   39.033817]  vfs_write+0x27c/0x378
[   39.033825]  ksys_write+0x64/0xf4
[   39.033833]  __arm64_sys_write+0x18/0x20
[   39.033841]  invoke_syscall+0x44/0x104
[   39.033852]  el0_svc_common.constprop.0+0xb4/0xd4
[   39.033862]  do_el0_svc+0x18/0x20
[   39.033870]  el0_svc+0x3c/0xf0
[   39.033880]  el0t_64_sync_handler+0xc0/0xc4
[   39.033888]  el0t_64_sync+0x154/0x158
[   39.041274] ravb 11c30000.ethernet eth0: Link is Down


Remediation:
Open Redirect in Grafana
CVE: CVE-2025-6197
Component: grafana
CWE: CWE-601
Severity: Low
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-07-22T00:00:00+00:00

A flaw was found in Grafana, where the organization switching functionality caused an open redirect vulnerability. To make this exploitable, the Grafana instance must have more than one organization, and the user being redirected must be a member of both. Furthermore, the attacker needs to know the ID of the organization that the user is currently viewing.

Statement: This vulnerability is considered Low severity because its exploitation relies on very restrictive preconditions that significantly limit its real-world impact. The Grafana instance must have multiple organizations, the targeted user must be a member of both organizations, and the attacker must already know the exact organization ID that the user is currently viewing—information that is typically inaccessible without prior compromise or insider knowledge. Additionally, the flaw does not directly expose sensitive data or allow privilege escalation; it only enables an open redirect under tightly constrained circumstances.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-0413
Component: Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability
Release date: 2025-02-04T22:04:33.373000+00:00

Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability. 
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability.

The specific flaw exists within the Technical Data Reporter component. By creating a symbolic link, an attacker can abuse the service to change the permissions of arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-25014.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2025-8473
Component: Alpine iLX-507 UPDM_wstpCBCUpdStart Command Injection Vulnerability
Release date: 2025-08-01T17:37:52.220000+00:00

Alpine iLX-507 UPDM_wstpCBCUpdStart Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the UPDM_wstpCBCUpdStart function. The issue results from the lack of proper validation of user-supplied data before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26317.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Bluetooth: vhci: Prevent use-after-free by removing debugfs files early
CVE: CVE-2025-39861
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-09-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: vhci: Prevent use-after-free by removing debugfs files early

Move the creation of debugfs files into a dedicated function, and ensure
they are explicitly removed during vhci_release(), before associated
data structures are freed.

Previously, debugfs files such as "force_suspend", "force_wakeup", and
others were created under hdev->debugfs but not removed in
vhci_release(). Since vhci_release() frees the backing vhci_data
structure, any access to these files after release would result in
use-after-free errors.

Although hdev->debugfs is later freed in hci_release_dev(), user can
access files after vhci_data is freed but before hdev->debugfs is
released.

Statement: The bug is a use-after-free in the Bluetooth vhci driver: debugfs files could remain accessible after vhci_release() freed the backing vhci_data, leading to UAF on file access. Exploitation requires local, highly-privileged access (to /dev/vhci and debugfs), so the realistic impact is a local kernel DoS only.

Remediation:
WebAssembly wabt binary-reader-interp.cc GetReturnCallDropKeepCount heap-based overflow
CVE: CVE-2025-2584
Component: wabt
CWE: CWE-122
Severity: Moderate
CVSS v3: 6.8/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H
Release date: 2025-03-21T07:31:03.732000+00:00

A flaw was found in WebAssembly WABT's BinaryReaderInterp component. This vulnerability allows remote attackers to cause a heap-based buffer overflow and potentially crash the application via specially crafted WebAssembly files lacking proper formatting, due to missing boundary checks in the GetReturnCallDropKeepCount function.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Linux kernel: Denial of service due to use-after-free in scsi: lpfc
CVE: CVE-2025-38289
Component: kernel
CWE: CWE-364
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-07-10T00:00:00+00:00

A flaw was found in the Linux kernel's scsi: lpfc component. This vulnerability involves a use-after-free error in the dev_loss_tmo_callbk function. During driver unload or fatal error handling, a previously freed object could be accessed. This could allow a local attacker to cause a system crash, leading to a denial of service.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
workqueue: Put the pwq after detaching the rescuer from the pool
CVE: CVE-2025-21786
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-02-27T00:00:00+00:00

A vulnerability was found in the Linux kernel's work queue subsystem, which manages background task execution. The issue stems from improper handling of the "rescuer" thread during the cleanup of unbound work queues.

Statement: Red Hat Product Security classifies this bug as Moderate based on the following reasons:

* Workqueues are not accessible to unprivileged users, such as SELinux lockdown. 
* Local access is required for this bug to work.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow
CVE: CVE-2025-57803
Component: imagemagick
CWE: CWE-190
Severity: Important
CVSS v3: 7.7/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-08-26T17:25:59.148000+00:00

A flaw was found in ImageMagick. In 32-bit builds, the Bitmap encoder miscalculates the stride value when processing images with very large with. Mathematically, the stride value is calculated as width multiplied by 3 but the theoretical limit of such value is 2^32 for 32-bit integers. So, if this value is exceeded, the encoder uses modulo to convert it down and then takes the smaller value as the actual stride length. This is problematic because the pixel data starts to overlap when being added to the buffer due to the small stride value messing up the rows. This heap buffer overflow allows an attacker to cause a denial of service or, with crafted input, potentially execute arbitrary code.

Statement: This vulnerability is specific to 32-bit ImageMagick builds. Red Hat predominantly only ships 64-bit builds of Kea on its platforms and so the vulnerability affects only customers that install i686 arch rpm packages as these are the only 32-bit builds Red Hat provides. The flaw occurs in the WriteBMPImage function when computing bytes_per_line for 24-bpp BMP images. An integer overflow causes the stride to underflow to a small value, while the writer still emits 3 × width bytes per row. The mismatch immediately produces a large, attacker-controlled heap overwrite.

Remediation:
idpf: fix possible vport_config NULL pointer deref in remove
CVE: CVE-2025-68213
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-16T00:00:00+00:00

A null pointer dereference was found in the Intel IDPF network driver in the Linux kernel. When a vport fails to initialize (e.g., during VF creation timeout), attempting to remove the driver crashes because idpf_remove() dereferences vport_config without checking for NULL.

Statement: This affects Intel Infrastructure Data Path Function (IDPF) devices, typically used in data center environments. The crash occurs only after initialization failures followed by driver removal.

Remediation:
GnuTLS: Denial of Service via excessive resource consumption during certificate verification
CVE: CVE-2025-14831
Component: gnutls
CWE: CWE-407
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).

Statement: This vulnerability is rated Moderate for Red Hat. GnuTLS is susceptible to a denial of service attack due to excessive CPU and memory consumption. This occurs when processing specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs) during certificate verification.

Remediation:
The Insights proxy container image provided here is downloaded by the Red Hat
Insights proxy product RPM.

Before applying this update, make sure all previously released errata relevant to
your system have been applied.
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection
CVE: CVE-2025-71198
Component: kernel
Severity: None
Release date: 2025-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection

The st_lsm6dsx_acc_channels array of struct iio_chan_spec has a non-NULL
event_spec field, indicating support for IIO events. However, event
detection is not supported for all sensors, and if userspace tries to
configure accelerometer wakeup events on a sensor device that does not
support them (e.g. LSM6DS0), st_lsm6dsx_write_event() dereferences a NULL
pointer when trying to write to the wakeup register.
Define an additional struct iio_chan_spec array whose members have a NULL
event_spec field, and use this array instead of st_lsm6dsx_acc_channels for
sensors without event detection capability.


Remediation:
mm/huge_memory: drop beyond-EOF folios with the right number of refs
CVE: CVE-2025-22000
Component: kernel
CWE: CWE-401
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Release date: 2025-04-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: drop beyond-EOF folios with the right number of refs

When an after-split folio is large and needs to be dropped due to EOF,
folio_put_refs(folio, folio_nr_pages(folio)) should be used to drop all
page cache refs.  Otherwise, the folio will not be freed, causing memory
leak.

This leak would happen on a filesystem with blocksize > page_size and a
truncate is performed, where the blocksize makes folios split to >0 order
ones, causing truncated folios not being freed.


Remediation:
CVE: CVE-2025-3004
Component: Sayski ForestBlog search cross site scripting
Release date: 2025-03-31T17:00:11.982000+00:00

A vulnerability has been found in Sayski ForestBlog up to 20250321 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /search. The manipulation of the argument keywords leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Vim path traversial
CVE: CVE-2025-53905
Component: vim
CWE: CWE-22
Severity: Moderate
CVSS v3: 4.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L
Release date: 2025-07-15T20:48:34.764000+00:00

A path traversal flaw was found in Vim. Successful exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive.


Remediation:
For more information visit https://access.redhat.com/errata/RHSA-2025:23080
For more information visit https://access.redhat.com/errata/RHSA-2025:23078
For more information visit https://access.redhat.com/errata/RHSA-2026:3461
For more information visit https://access.redhat.com/errata/RHSA-2026:3462
For more information visit https://access.redhat.com/errata/RHSA-2025:23079
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
The Insights proxy container image provided here is downloaded by the Red Hat
Insights proxy product RPM.

Before applying this update, make sure all previously released errata relevant to
your system have been applied.
The Insights proxy container image provided here is downloaded by the Red Hat
Insights proxy product RPM.

Before applying this update, make sure all previously released errata relevant to
your system have been applied.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.