huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Linux kernel (openvswitch): Denial of Service and limited data exposure via improper key length validation
CVE: CVE-2025-37789
Component: kernel
CWE: CWE-20
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Release date: 2025-05-01T00:00:00+00:00

A flaw was found in the Linux kernel's openvswitch virtual environment. A local attacker with low privileges could exploit improper data and key length validation in the `set()` action. This could lead to a denial of service, making the system unresponsive, and potentially result in limited information disclosure.

Statement: A denial of service, and a limited data exposure can be observed if the data/key validation is not correctly validated in validate_set in net/openvswitch/flow_netlink.c in the Linux Kernel openvswitch virtual environment.  

This flaw could allow an attacker to crash the system or leak internal kernel information problem.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
firefox: Some non-writable Object properties could be modified
CVE: CVE-2025-11711
Component: thunderbird
CWE: CWE-284
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-10-14T12:27:34.470000+00:00

A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue:
There was a way to change the value of JavaScript Object properties that were supposed to be non-writeable.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
out-of-bounds read in CAPECharacterHelper::GetUTF16FromUTF8
CVE: CVE-2025-61043
Component: monkeysaudio
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-28T00:00:00+00:00

A flaw was found in Monkey Audio. An improper handling of the length of UTF-8 strings in the CAPECharacterHelper::GetUTF16FromUTF8 function can cause an out-of-bounds read. This vulnerability can be exploited to expose sensitive information or potentially cause a crash, resulting in a denial of service.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Next.js Race Condition to Cache Poisoning
CVE: CVE-2025-32421
Component: next.js
CWE: CWE-362
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-05-14T22:56:45.624000+00:00

A flaw was found in Next.js. This vulnerability allows an endpoint to serve `pageProps` data instead of standard HTML via a race condition under specific misconfigurations.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
spufs: fix a leak in spufs_create_context()
CVE: CVE-2025-22071
Component: kernel
Severity: None
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

spufs: fix a leak in spufs_create_context()

Leak fixes back in 2008 missed one case - if we are trying to set affinity
and spufs_mkdir() fails, we need to drop the reference to neighbor.


Remediation:
xfrm: Duplicate SPI Handling
CVE: CVE-2025-39797
Component: kernel
CWE: CWE-703
Severity: Moderate
CVSS v3: 5.2/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-09-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

xfrm: Duplicate SPI Handling

The issue originates when Strongswan initiates an XFRM_MSG_ALLOCSPI
Netlink message, which triggers the kernel function xfrm_alloc_spi().
This function is expected to ensure uniqueness of the Security Parameter
Index (SPI) for inbound Security Associations (SAs). However, it can
return success even when the requested SPI is already in use, leading
to duplicate SPIs assigned to multiple inbound SAs, differentiated
only by their destination addresses.

This behavior causes inconsistencies during SPI lookups for inbound packets.
Since the lookup may return an arbitrary SA among those with the same SPI,
packet processing can fail, resulting in packet drops.

According to RFC 4301 section 4.4.2 , for inbound processing a unicast SA
is uniquely identified by the SPI and optionally protocol.

Reproducing the Issue Reliably:
To consistently reproduce the problem, restrict the available SPI range in
charon.conf : spi_min = 0x10000000 spi_max = 0x10000002
This limits the system to only 2 usable SPI values.
Next, create more than 2 Child SA. each using unique pair of src/dst address.
As soon as the 3rd Child SA is initiated, it will be assigned a duplicate
SPI, since the SPI pool is already exhausted.
With a narrow SPI range, the issue is consistently reproducible.
With a broader/default range, it becomes rare and unpredictable.

Current implementation:
xfrm_spi_hash() lookup function computes hash using daddr, proto, and family.
So if two SAs have the same SPI but different destination addresses, then
they will:
a. Hash into different buckets
b. Be stored in different linked lists (byspi + h)
c. Not be seen in the same hlist_for_each_entry_rcu() iteration.
As a result, the lookup will result in NULL and kernel allows that Duplicate SPI

Proposed Change:
xfrm_state_lookup_spi_proto() does a truly global search - across all states,
regardless of hash bucket and matches SPI and proto.

Statement: The patch fixes a logic flaw in XFRM SPI allocation where xfrm_alloc_spi() could succeed even if the requested SPI was already in use on another inbound SA (different dst). That lets multiple inbound SAs share the same SPI+proto, so inbound lookups may hit the “wrong” SA or none at all, causing IPsec packet drops (DoS). It’s reliably reproducible by constraining the SPI range (e.g., 0x10000000–0x10000002) and creating more Child SAs than available SPIs. The main risk is remote DoS.
Triggering this issue requires interaction at the IKE/IPsec control plane — it can only be exercised when an IKE daemon (for example strongSwan, LibreSwan, racoon or OpenSwan) is present and issues XFRM (netlink) requests to create SAs.

Remediation:
zstd - fix double-free in per-CPU stream cleanup
CVE: CVE-2025-68262
Component: crypto
Release date: 2025-12-16T14:45:04.198000+00:00

In the Linux kernel, the following vulnerability has been resolved:

crypto: zstd - fix double-free in per-CPU stream cleanup

The crypto/zstd module has a double-free bug that occurs when multiple
tfms are allocated and freed.

The issue happens because zstd_streams (per-CPU contexts) are freed in
zstd_exit() during every tfm destruction, rather than being managed at
the module level.  When multiple tfms exist, each tfm exit attempts to
free the same shared per-CPU streams, resulting in a double-free.

This leads to a stack trace similar to:

  BUG: Bad page state in process kworker/u16:1  pfn:106fd93
  page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106fd93
  flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)
  page_type: 0xffffffff()
  raw: 0017ffffc0000000 dead000000000100 dead000000000122 0000000000000000
  raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
  page dumped because: nonzero entire_mapcount
  Modules linked in: ...
  CPU: 3 UID: 0 PID: 2506 Comm: kworker/u16:1 Kdump: loaded Tainted: G    B
  Hardware name: ...
  Workqueue: btrfs-delalloc btrfs_work_helper
  Call Trace:
   <TASK>
   dump_stack_lvl+0x5d/0x80
   bad_page+0x71/0xd0
   free_unref_page_prepare+0x24e/0x490
   free_unref_page+0x60/0x170
   crypto_acomp_free_streams+0x5d/0xc0
   crypto_acomp_exit_tfm+0x23/0x50
   crypto_destroy_tfm+0x60/0xc0
   ...

Change the lifecycle management of zstd_streams to free the streams only
once during module cleanup.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Drupal Http Client Manager: Information disclosure due to insufficient data separation
CVE: CVE-2025-14840
Component: drupal
CVSS v3: 2.7/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-12-17T17:47:13+00:00

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal HTTP Client Manager allows Forceful Browsing.This issue affects HTTP Client Manager: from 0.0.0 before 9.3.13, from 10.0.0 before 10.0.2, from 11.0.0 before 11.0.1.

Statement: This vulnerability doesn't affect any supported Red Hat product.

Remediation:
External cohort search service leaks system cohort data
CVE: CVE-2025-62395
Component: moodle
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-10-14T04:00:00+00:00

A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restricted administrative data.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
NVIDIA Nsight Systems for Linux: Privilege escalation and code execution via OS command injection in installer
CVE: CVE-2025-33230
Component: nsight-systems
CWE: CWE-78
Severity: Moderate
CVSS v3: 6.0/AV:P/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in the NVIDIA Nsight Systems for Linux installer. An attacker could exploit this vulnerability by providing a malicious string as the installation path, leading to an operating system (OS) command injection. A successful exploit could result in escalation of privileges, arbitrary code execution, data tampering, denial of service, and information disclosure.

Statement: This vulnerability is rated Important as it impacts the NVIDIA Nsight Systems installer. An attacker could achieve OS command injection by providing a malicious installation path during the execution of the installer. This could lead to escalation of privileges and arbitrary code execution on affected systems running NVIDIA Nsight Systems.

Remediation:
Encrypted values of secrets stored in view configuration revealed to users with View/Read permission
CVE: CVE-2025-27623
Component: jenkins
CWE: CWE-523
Severity: Moderate
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-03-05T22:33:35.469000+00:00

A flaw was found in Jenkins. Affected versions of Jenkins do not redact encrypted values of secrets when accessing the `config.xml` of views via REST API or CLI. This flaw allows attackers with view/read permission to view encrypted values of secrets.


Remediation:
perf/x86/amd: Check event before enable to avoid GPF
CVE: CVE-2025-68798
Component: kernel
CWE: CWE-367
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A race condition flaw was found in the Linux kernel's AMD performance monitoring unit (PMU) code. A subtle timing window exists between NMI-triggered throttling (which clears an event pointer) and amd_pmu_enable_all() (which dereferences it). This can result in a NULL pointer dereference and kernel crash on AMD systems using perf.

Statement: This vulnerability affects only AMD processors and requires active use of the perf subsystem. The race window is narrow but was reproducible by syzkaller fuzzing. Intel and other x86 platforms are not affected by this specific code path.

Remediation:
Stack overflow due to object loop in PDF CMap
CVE: CVE-2025-11896
Component: Xpdf
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-10-16T21:59:45.136000+00:00

A flaw was found in Xpdf. A PDF object loop in a CMap, via the "UseCMap" entry leads to an infinite recursion and a stack overflow, resulting in an application crash.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
PCRE2: heap-buffer-overflow read in match_ref due to missing boundary restoration in SCS
CVE: CVE-2025-58050
Component: pcre2
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2025-08-27T18:47:35.041000+00:00

The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regular expression matching engine, specifically within the handling of the (*scs:...) (Scan SubString) verb when combined with (*ACCEPT) in src/pcre2_match.c. This vulnerability may potentially lead to information disclosure if the out-of-bounds data read during the memcmp affects the final match result in a way observable by the attacker. This issue has been resolved in version 10.46.

Statement: The bug is in src/pcre2_match.c. When (*scs:...) temporarily restricts the match boundaries to a captured substring, the engine restores the current subject pointer (Feptr) correctly on an immediate (*ACCEPT), but it fails to restore mb->end_subject and mb->true_end_subject. If execution later calls match_ref (for example for a backreference like \2), the bounds check can underflow because mb->end_subject - eptr becomes negative and is cast to an unsigned size. That makes the length check pass incorrectly and memcmp reads past the end of the allocated buffer, causing a heap-buffer-overflow read.

Remediation:
MinIO performs incomplete signature validation for unsigned-trailer uploads
CVE: CVE-2025-31489
Component: minio
CWE: CWE-347
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2025-04-03T19:36:09.335000+00:00

A flaw was found in the Minio package. The signature component of the authorization may be invalid, which would mean that, as a client, you can use any arbitrary secret to upload objects, given the user already has prior WRITE permissions on the bucket. Prior knowledge of the access key and bucket name this user might have access to is necessary, and an access key with WRITE permissions is necessary. However, with relevant information in place, uploading random objects to buckets is trivial and easy via curl.


Remediation:
ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers
CVE: CVE-2025-21870
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-03-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers

Other, non DAI copier widgets could have the same  stream name (sname) as
the ALH copier and in that case the copier->data is NULL, no alh_data is
attached, which could lead to NULL pointer dereference.
We could check for this NULL pointer in sof_ipc4_prepare_copier_module()
and avoid the crash, but a similar loop in sof_ipc4_widget_setup_comp_dai()
will miscalculate the ALH device count, causing broken audio.

The correct fix is to harden the matching logic by making sure that the
1. widget is a DAI widget - so dai = w->private is valid
2. the dai (and thus the copier) is ALH copier


Remediation:
fbdev: fix potential buffer overflow in do_register_framebuffer()
CVE: CVE-2025-38702
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Release date: 2025-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

fbdev: fix potential buffer overflow in do_register_framebuffer()

The current implementation may lead to buffer overflow when:
1.  Unregistration creates NULL gaps in registered_fb[]
2.  All array slots become occupied despite num_registered_fb < FB_MAX
3.  The registration loop exceeds array bounds

Add boundary check to prevent registered_fb[FB_MAX] access.

Statement: A flaw was found in fbdev’s do_register_framebuffer() where gaps in registered_fb[] combined with a full array could let the loop step past FB_MAX, causing an out-of-bounds access and kernel memory corruption. This is locally reachable only through privileged framebuffer registration paths (e.g., driver probe/hotplug) and can lead to system instability or crash.
Exploitable only on systems that actually use the legacy fbdev stack. Modern desktops/servers typically don’t expose or rely on /dev/fb*.

Remediation:
bnxt_en: Fix memory corruption when FW resources change during ifdown
CVE: CVE-2025-39810
Component: kernel
CWE: CWE-131
Severity: Moderate
CVSS v3: 6.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
Release date: 2025-09-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix memory corruption when FW resources change during ifdown

bnxt_set_dflt_rings() assumes that it is always called before any TC has
been created.  So it doesn't take bp->num_tc into account and assumes
that it is always 0 or 1.

In the FW resource or capability change scenario, the FW will return
flags in bnxt_hwrm_if_change() that will cause the driver to
reinitialize and call bnxt_cancel_reservations().  This will lead to
bnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp->num_tc
may be greater than 1.  This will cause bp->tx_ring[] to be sized too
small and cause memory corruption in bnxt_alloc_cp_rings().

Fix it by properly scaling the TX rings by bp->num_tc in the code
paths mentioned above.  Add 2 helper functions to determine
bp->tx_nr_rings and bp->tx_nr_rings_per_tc.

Statement: This vulnerability is rated Moderate for Red Hat Enterprise Linux 8 and 9. A memory corruption flaw exists in the `bnxt_en` kernel driver, which could be triggered when firmware resources change during an interface down operation. Triggering this vulnerability requires elevated privileges (ex. `CAP_NET_ADMIN`) as configuring traffic classes is a privileged operation. If the vulnerability is triggered, then the primary impact will be on integrity and availability, as the bug can cause kernel memory corruption in the kernel heap structures related to network i/o, which in turn can lead to a kernel crash. Confidentiality is most probably not impacted, as an out-of-bounds write could overwrite adjacent kernel memory, but no direct read exposure is implied. 

Red Hat Enterprise Linux 6, 7, and Red Hat In-Vehicle OS are not affected as the vulnerable code is not present in these versions.

Remediation:
Nextcloud Server admin_audit does not log all actions on files in groupfolders
CVE: CVE-2025-66552
Component: nextcloud-server
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-12-05T16:36:39.749000+00:00

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app to not properly log all actions on files and folders inside groupfolders. This vulnerability is fixed in Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
InnoDB unspecified vulnerability (CPU Jan 2025)
CVE: CVE-2025-21523
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-21T20:53:05.511000+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and  9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
pinctrl: check the return value of pinmux_ops::get_function_name()
CVE: CVE-2025-40030
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: check the return value of pinmux_ops::get_function_name()

While the API contract in docs doesn't specify it explicitly, the
generic implementation of the get_function_name() callback from struct
pinmux_ops - pinmux_generic_get_function_name() - can fail and return
NULL. This is already checked in pinmux_check_ops() so add a similar
check in pinmux_func_name_to_selector() instead of passing the returned
pointer right down to strcmp() where the NULL can get dereferenced. This
is normal operation when adding new pinfunctions.

Statement: The patch fixes a potential NULL pointer dereference in pinmux_func_name_to_selector() when pinmux_ops::get_function_name()
returns NULL (e.g., during addition of new pin functions).
Without this check, strcmp() could access an invalid pointer, leading to a kernel oops during driver initialization.
No remote or unprivileged attack surface: impact limited to local crash when loading or probing faulty pinctrl drivers.

Remediation: