huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
netfs: Call `invalidate_cache` only if implemented
CVE: CVE-2025-22002
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfs: Call `invalidate_cache` only if implemented

Many filesystems such as NFS and Ceph do not implement the
`invalidate_cache` method.  On those filesystems, if writing to the
cache (`NETFS_WRITE_TO_CACHE`) fails for some reason, the kernel
crashes like this:

 BUG: kernel NULL pointer dereference, address: 0000000000000000
 #PF: supervisor instruction fetch in kernel mode
 #PF: error_code(0x0010) - not-present page
 PGD 0 P4D 0
 Oops: Oops: 0010 [#1] SMP PTI
 CPU: 9 UID: 0 PID: 3380 Comm: kworker/u193:11 Not tainted 6.13.3-cm4all1-hp #437
 Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 10/17/2018
 Workqueue: events_unbound netfs_write_collection_worker
 RIP: 0010:0x0
 Code: Unable to access opcode bytes at 0xffffffffffffffd6.
 RSP: 0018:ffff9b86e2ca7dc0 EFLAGS: 00010202
 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 7fffffffffffffff
 RDX: 0000000000000001 RSI: ffff89259d576a18 RDI: ffff89259d576900
 RBP: ffff89259d5769b0 R08: ffff9b86e2ca7d28 R09: 0000000000000002
 R10: ffff89258ceaca80 R11: 0000000000000001 R12: 0000000000000020
 R13: ffff893d158b9338 R14: ffff89259d576900 R15: ffff89259d5769b0
 FS:  0000000000000000(0000) GS:ffff893c9fa40000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: ffffffffffffffd6 CR3: 000000054442e003 CR4: 00000000001706f0
 Call Trace:
  <TASK>
  ? __die+0x1f/0x60
  ? page_fault_oops+0x15c/0x460
  ? try_to_wake_up+0x2d2/0x530
  ? exc_page_fault+0x5e/0x100
  ? asm_exc_page_fault+0x22/0x30
  netfs_write_collection_worker+0xe9f/0x12b0
  ? xs_poll_check_readable+0x3f/0x80
  ? xs_stream_data_receive_workfn+0x8d/0x110
  process_one_work+0x134/0x2d0
  worker_thread+0x299/0x3a0
  ? __pfx_worker_thread+0x10/0x10
  kthread+0xba/0xe0
  ? __pfx_kthread+0x10/0x10
  ret_from_fork+0x30/0x50
  ? __pfx_kthread+0x10/0x10
  ret_from_fork_asm+0x1a/0x30
  </TASK>
 Modules linked in:
 CR2: 0000000000000000

This patch adds the missing `NULL` check.


Remediation:
OpenStack Keystone: Unauthorized access and privilege escalation via AWS signature validation flaw
CVE: CVE-2025-65073
Component: openstack-keystone
CWE: CWE-863
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Release date: 2025-11-17T00:00:00+00:00

A flaw was found in OpenStack Keystone. This vulnerability allows an attacker to obtain a valid OpenStack's Keystone token, leading to access to unauthorized resources or privilege escalation within the OpenStack instance via sending a valid AWS (Amazon Web Services) signature to the /v3/ec2tokens or /v3/s3tokens API (Application Programming Interface) endpoints.

Statement: This vulnerability allows an attacker to obtain a valid OpenStack's Keystone token belonging to a valid user by sending a valid AWS signature to the /v3/ec2tokens or /v3/s3tokens API's endpoints, leading to access to unauthorized resources or privilege escalation within the OpenStack instance.

This attack is considered to have a high complexity (AC:H) due to the fact of obtaining such valid AWS token is not straight forward. To be considered vulnerable, the OpenStack deployments should expose the related API end points through a public API or external access.

Remediation:
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
KDE Connect: Application crash via malicious device IDs
CVE: CVE-2025-32901
Component: kde-connect
CVSS v3: 4.2/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-12-05T00:00:00+00:00

A flaw was found in KDE Connect. This vulnerability allows an application crash via malicious device IDs sent via broadcast UDP (User Datagram Protocol).

Statement: This vulnerability is rated Moderate for Red Hat. It allows a remote attacker on the same local network segment to cause a denial of service (application crash) in KDE Connect by sending specially crafted broadcast UDP packets. This affects KDE Connect before version 1.33.0 on Android, impacting systems where KDE Connect is deployed and exposed to untrusted local networks.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
A crafted zone can lead to an illegal memory access in the PowerDNS Recursor
CVE: CVE-2025-30195
Component: pdns-recursor
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-07T13:24:17.879000+00:00

A flaw was found in the PowerDNS Recursor. This vulnerability allows a denial of service via the publication of specially crafted DNS zones containing specific Resource Record Sets. Processing and caching these records can trigger illegal memory access, leading to a crash.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net: bridge: fix use-after-free due to MST port state bypass
CVE: CVE-2025-40297
Component: kernel
CWE: CWE-367
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-08T00:00:00+00:00

A use-after-free was found in the Linux bridge networking code. When MST (Multiple Spanning Tree) is enabled and VLAN filtering is disabled, FDB learning can bypass the port state check during port deletion. This allows learning to occur on a port being deleted, leading to use-after-free when accessing freed FDB entries.

Statement: Exploitation requires a bridge configuration with MST enabled and VLAN filtering disabled, combined with specific timing during port deletion. Standard bridge configurations are less likely to be affected.

Remediation:
drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode()
CVE: CVE-2025-21784
Component: kernel
Severity: None
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode()

In function psp_init_cap_microcode(), it should bail out when failed to
load firmware, otherwise it may cause invalid memory access.


Remediation:
CVE: CVE-2025-0411
Component: 7-Zip Mark-of-the-Web Bypass Vulnerability
Release date: 2025-01-20T02:13:03.900000+00:00

7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
smb: Log an error when close_all_cached_dirs fails
CVE: CVE-2025-38321
Component: kernel
CWE: CWE-911
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

smb: Log an error when close_all_cached_dirs fails

Under low-memory conditions, close_all_cached_dirs() can't move the
dentries to a separate list to dput() them once the locks are dropped.
This will result in a "Dentry still in use" error, so add an error
message that makes it clear this is what happened:

[  495.281119] CIFS: VFS: \\otters.example.com\share Out of memory while dropping dentries
[  495.281595] ------------[ cut here ]------------
[  495.281887] BUG: Dentry ffff888115531138{i=78,n=/}  still in use (2) [unmount of cifs cifs]
[  495.282391] WARNING: CPU: 1 PID: 2329 at fs/dcache.c:1536 umount_check+0xc8/0xf0

Also, bail out of looping through all tcons as soon as a single
allocation fails, since we're already in trouble, and kmalloc() attempts
for subseqeuent tcons are likely to fail just like the first one did.


Remediation:
Privilege Escalation in Keycloak Admin Console (FGAPv2 Enabled)
CVE: CVE-2025-7784
Component: org.keycloak/keycloak-services
CWE: CWE-269
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Release date: 2025-07-18T00:00:00+00:00

A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin Permissions(FGAPv2) are enabled. An administrative user with the manage-users role can escalate their privileges to realm-admin due to improper privilege enforcement. This vulnerability allows unauthorized elevation of access rights, compromising the intended separation of administrative duties and posing a security risk to the realm.

Statement: The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate. While the flaw requires an already privileged user, with manage-users, and an FGAPv2-enabled realm, successful exploitation allows complete administrative takeover of a Keycloak realm. This could lead to unauthorized changes to users, roles, and realm configurations. The vulnerability is particularly concerning in environments where multiple administrative users have restricted scopes.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net: nfc: nci: Add parameter validation for packet data
CVE: CVE-2025-40043
Component: kernel
Severity: None
Release date: 2025-10-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: nfc: nci: Add parameter validation for packet data

Syzbot reported an uninitialized value bug in nci_init_req, which was
introduced by commit 5aca7966d2a7 ("Merge tag
'perf-tools-fixes-for-v6.17-2025-09-16' of
git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools").

This bug arises due to very limited and poor input validation
that was done at nic_valid_size(). This validation only
validates the skb->len (directly reflects size provided at the
userspace interface) with the length provided in the buffer
itself (interpreted as NCI_HEADER). This leads to the processing
of memory content at the address assuming the correct layout
per what opcode requires there. This leads to the accesses to
buffer of `skb_buff->data` which is not assigned anything yet.

Following the same silent drop of packets of invalid sizes at
`nic_valid_size()`, add validation of the data in the respective
handlers and return error values in case of failure. Release
the skb if error values are returned from handlers in
`nci_nft_packet` and effectively do a silent drop

Possible TODO: because we silently drop the packets, the
call to `nci_request` will be waiting for completion of request
and will face timeouts. These timeouts can get excessively logged
in the dmesg. A proper handling of them may require to export
`nci_request_cancel` (or propagate error handling from the
nft packets handlers).


Remediation:
Artifex Ghostscript: Denial of Service via stack-based buffer overflow in pdf_write_cmap
CVE: CVE-2025-59798
Component: Artifex Ghostscript
CWE: CWE-121
Severity: Moderate
CVSS v3: 3.9/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-09-22T00:00:00+00:00

A flaw was found in Artifex Ghostscript. This vulnerability, a stack-based buffer overflow, exists within the pdf_write_cmap function. An attacker could exploit this by providing malicious input, potentially leading to a denial of service (DoS) where the application becomes unresponsive.

Statement: This vulnerability is rated Moderate for Red Hat products. A stack-based buffer overflow in Artifex Ghostscript's `pdf_write_cmap` function can lead to a denial of service. Exploitation requires processing a specially crafted PDF file, causing the application to become unresponsive.

Remediation:
Unauthenticated Metrics Flooding in OpenShift Lightspeed Service Leading to Resource Exhaustion
CVE: CVE-2025-2586
Component: ols
CWE: CWE-400
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-03-31T08:00:00+00:00

A flaw was found in the OpenShift Lightspeed Service, which is vulnerable to unauthenticated API request flooding. Repeated queries to non-existent endpoints inflate metrics storage and processing, consuming excessive resources. This issue can lead to monitoring system degradation, increased disk usage, and potential service unavailability. Since the issue does not require authentication, an external attacker can exhaust CPU, RAM, and disk space, impacting both application and cluster stability.

Statement: This flaw was fixed in OpenShift Lightspeed Tech Preview v0.3.3, as such it has been marked Not Affected.

Remediation:
LoongArch: Fix warnings during S3 suspend
CVE: CVE-2025-21803
Component: kernel
CWE: CWE-662
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: Fix warnings during S3 suspend

The enable_gpe_wakeup() function calls acpi_enable_all_wakeup_gpes(),
and the later one may call the preempt_schedule_common() function,
resulting in a thread switch and causing the CPU to be in an interrupt
enabled state after the enable_gpe_wakeup() function returns, leading
to the warnings as follow.

[ C0] WARNING: ... at kernel/time/timekeeping.c:845 ktime_get+0xbc/0xc8
[ C0]          ...
[ C0] Call Trace:
[ C0] [<90000000002243b4>] show_stack+0x64/0x188
[ C0] [<900000000164673c>] dump_stack_lvl+0x60/0x88
[ C0] [<90000000002687e4>] __warn+0x8c/0x148
[ C0] [<90000000015e9978>] report_bug+0x1c0/0x2b0
[ C0] [<90000000016478e4>] do_bp+0x204/0x3b8
[ C0] [<90000000025b1924>] exception_handlers+0x1924/0x10000
[ C0] [<9000000000343bbc>] ktime_get+0xbc/0xc8
[ C0] [<9000000000354c08>] tick_sched_timer+0x30/0xb0
[ C0] [<90000000003408e0>] __hrtimer_run_queues+0x160/0x378
[ C0] [<9000000000341f14>] hrtimer_interrupt+0x144/0x388
[ C0] [<9000000000228348>] constant_timer_interrupt+0x38/0x48
[ C0] [<90000000002feba4>] __handle_irq_event_percpu+0x64/0x1e8
[ C0] [<90000000002fed48>] handle_irq_event_percpu+0x20/0x80
[ C0] [<9000000000306b9c>] handle_percpu_irq+0x5c/0x98
[ C0] [<90000000002fd4a0>] generic_handle_domain_irq+0x30/0x48
[ C0] [<9000000000d0c7b0>] handle_cpu_irq+0x70/0xa8
[ C0] [<9000000001646b30>] handle_loongarch_irq+0x30/0x48
[ C0] [<9000000001646bc8>] do_vint+0x80/0xe0
[ C0] [<90000000002aea1c>] finish_task_switch.isra.0+0x8c/0x2a8
[ C0] [<900000000164e34c>] __schedule+0x314/0xa48
[ C0] [<900000000164ead8>] schedule+0x58/0xf0
[ C0] [<9000000000294a2c>] worker_thread+0x224/0x498
[ C0] [<900000000029d2f0>] kthread+0xf8/0x108
[ C0] [<9000000000221f28>] ret_from_kernel_thread+0xc/0xa4
[ C0]
[ C0] ---[ end trace 0000000000000000 ]---

The root cause is acpi_enable_all_wakeup_gpes() uses a mutex to protect
acpi_hw_enable_all_wakeup_gpes(), and acpi_ut_acquire_mutex() may cause
a thread switch. Since there is no longer concurrent execution during
loongarch_acpi_suspend(), we can call acpi_hw_enable_all_wakeup_gpes()
directly in enable_gpe_wakeup().

The solution is similar to commit 22db06337f590d01 ("ACPI: sleep: Avoid
breaking S3 wakeup due to might_sleep()").


Remediation:
go crypto/tls ALPN negotiation error contains attacker controlled information
CVE: CVE-2025-58189
Component: crypto/tls
CWE: CWE-117
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2025-10-29T22:10:12.947000+00:00

The crypto/tls conn.Handshake method returns an error on the server-side when ALPN negotation fails which can contain arbitrary attacker controlled information provided by the client-side of the connection which is not escaped. This affects programs which log these errors without any additional form of sanitization, and may allow injection of attacker controlled information into logs.


Remediation:
ksmbd: fix out-of-bounds in parse_sec_desc()
CVE: CVE-2025-21946
Component: kernel
Severity: None
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix out-of-bounds in parse_sec_desc()

If osidoffset, gsidoffset and dacloffset could be greater than smb_ntsd
struct size. If it is smaller, It could cause slab-out-of-bounds.
And when validating sid, It need to check it included subauth array size.


Remediation:
tomcat: Apache Tomcat: console manipulation
CVE: CVE-2025-55754
Component: org.apache.tomcat/tomcat-juli
CWE: CWE-150
Severity: Moderate
CVSS v3: 3.7/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Release date: 2025-10-27T17:29:50.756000+00:00

An improper input neutralization flaw has been discovered in Apache Tomcat. 
Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems.


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.

The References section of this erratum contains a download link for the update. You must be logged in to download the update.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
mtd: inftlcore: Add error check for inftl_read_oob()
CVE: CVE-2025-37892
Component: kernel
CWE: CWE-252
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mtd: inftlcore: Add error check for inftl_read_oob()

In INFTL_findwriteunit(), the return value of inftl_read_oob()
need to be checked. A proper implementation can be
found in INFTL_deleteblock(). The status will be set as
SECTOR_IGNORE to break from the while-loop correctly
if the inftl_read_oob() fails.


Remediation:
Out-of-memory when loading Plist
CVE: CVE-2025-13837
Component: cpython
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.9/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
Release date: 2025-12-01T18:13:32.739000+00:00

A flaw was found in the plistlib module in the Python standard library. The amount of data to read from a Plist file is specified in the file itself. This issue allows a specially crafted Plist file to cause an application to allocate a large amount of memory, potentially resulting in allocations errors, swapping, out-of-memory conditions or even system freezes.

Statement: This issue can only be exploited by Python applications processing malicious or untrusted Plist files, which are not typically done in Linux systems or applications. Furthermore, this flaw can cause only a denial of service with no other security impact. Due to these reasons, this vulnerability has been rated with a moderate severity.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Event injection in saltstack
CVE: CVE-2025-22239
Component: salt
CVSS v3: 7.3/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Release date: 2025-06-13T07:00:53.681000+00:00

Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
tracing: Verify event formats that have "%*p.."
CVE: CVE-2025-37938
Component: kernel
Severity: Low
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tracing: Verify event formats that have "%*p.."

The trace event verifier checks the formats of trace events to make sure
that they do not point at memory that is not in the trace event itself or
in data that will never be freed. If an event references data that was
allocated when the event triggered and that same data is freed before the
event is read, then the kernel can crash by reading freed memory.

The verifier runs at boot up (or module load) and scans the print formats
of the events and checks their arguments to make sure that dereferenced
pointers are safe. If the format uses "%*p.." the verifier will ignore it,
and that could be dangerous. Cover this case as well.

Also add to the sample code a use case of "%*pbl".

Statement: This patch extends the kernel’s trace event verifier to properly detect and block unsafe pointer dereferencing when using formats like %*p.. (e.g., %*pbl).
Without this fix, trace events could dereference freed or invalid memory, potentially leading to kernel crashes if accessed later.

Remediation:
Exiv2 has quadratic performance in ICC profile parsing
CVE: CVE-2025-55304
Component: exiv2
CWE: CWE-407
Severity: Low
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-08-29T15:00:05.975000+00:00

A denial of service flaw was found in exiv2. A quadratic algorithm in the ICC profile parsing code in the jpegBase::readMetadata() function can cause Exiv2 to run for a long time. When Exiv2 is used to read the metadata of a crafted jpg image file, it triggers a denial of service.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.