huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero
CVE: CVE-2026-23206
Component: kernel
CWE: CWE-839
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero

The driver allocates arrays for ports, FDBs, and filter blocks using
kcalloc() with ethsw->sw_attr.num_ifs as the element count. When the
device reports zero interfaces (either due to hardware configuration
or firmware issues), kcalloc(0, ...) returns ZERO_SIZE_PTR (0x10)
instead of NULL.

Later in dpaa2_switch_probe(), the NAPI initialization unconditionally
accesses ethsw->ports[0]->netdev, which attempts to dereference
ZERO_SIZE_PTR (address 0x10), resulting in a kernel panic.

Add a check to ensure num_ifs is greater than zero after retrieving
device attributes. This prevents the zero-sized allocations and
subsequent invalid pointer dereference.

Statement: A denial of service issue exists in the dpaa2 switch driver when the device reports zero interfaces. The driver allocates several per interface arrays using kcalloc with ethsw sw_attr num_ifs as the element count. When num_ifs is 0 kcalloc may return ZERO_SIZE_PTR 0x10 instead of NULL. Later during probe the initialization path assumes at least one port exists and unconditionally accesses ethsw ports 0 netdev. If ports points to ZERO_SIZE_PTR this becomes an invalid pointer dereference at address 0x10 which triggers a kernel panic. The vulnerable condition can be reached during device initialization when hardware configuration or firmware reports an unexpected attribute set. Exploitation is typically local because it requires the presence of a dpaa2 switch device and driver probe. No special privileges are required beyond being able to trigger driver loading, for example via automatic module loading on systems where this hardware is present. The primary impact is availability loss. For the CVSS the PR:N metric is used because the attacker does not need elevated permissions inside the kernel. The attack surface is local rather than network because the condition occurs in probe before normal datapath operations.

Remediation:
thunderbird: Sandbox escape in the Graphics: WebRender component
CVE: CVE-2026-2761
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:01.011000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Sandbox escape in the Graphics: WebRender component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
irqchip/gic-v3-its: Avoid truncating memory addresses
CVE: CVE-2026-23085
Component: kernel
CWE: CWE-681
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

An address truncation vulnerability was found in the Linux kernel's GICv3 ITS interrupt controller driver on 32-bit ARM systems with LPAE (Large Physical Address Extension). Physical addresses above 4GB are incorrectly stored in 32-bit unsigned long variables, causing address truncation. When kmalloc() returns memory from ZONE_NORMAL above 4GB, the truncated address causes the GICv3 driver to crash.

Statement: This vulnerability specifically affects 32-bit ARM systems with LPAE enabled and physical memory above 4GB. It was discovered in QEMU virtual machine environments with larger VMSPLIT configurations. Standard 64-bit systems and 32-bit systems without high memory are not affected. The crash occurs during boot, preventing the system from starting.

Remediation:
Multer: Denial of Service via malformed requests
CVE: CVE-2026-3520
Component: multer
CWE: CWE-770
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-04T16:17:18.962000+00:00

A denial of service flaw was found in Multer, a Node.js middleware for handling `multipart/form-data`. A remote attacker can send specially crafted malformed requests which may induce a stack overflow. This can lead to a Denial of Service (DoS) making the service unavailable.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Use-after-free in the Layout: Scrolling and Overflow component
CVE: CVE-2026-24869
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-01-27T15:58:48.799000+00:00

Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability affects Firefox < 147.0.2.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
tracker-miners: GNOME localsearch MP3 Extractor: Heap buffer overflow leading to denial of service or information disclosure via malformed MP3 ID3 tags
CVE: CVE-2026-1767
Component: localsearch
CWE: CWE-805
Severity: Moderate
CVSS v3: 5.7/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
Release date: 2026-02-02T11:11:00+00:00

A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3 Extractor `tracker-extract-mp3` component. A remote attacker could exploit this heap buffer overflow vulnerability by providing a specially crafted MP3 file containing malformed ID3 tags. This incorrect length calculation during the parsing of performer tags can lead to a read beyond the allocated buffer, potentially causing a Denial of Service (DoS) due to a crash or enabling information disclosure.

Statement: This vulnerability has MODERATE impact. A heap buffer overflow in the GNOME localsearch MP3 Extractor (`tracker-extract-mp3`). A specially crafted MP3 file with malformed ID3 tags can cause the `tracker-extract` process to read beyond its allocated buffer. This can lead to a denial of service through application crashes or potentially information disclosure. This vulnerability requires local processing of a malicious MP3 file.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
BusyBox: Arbitrary file overwrite and potential code execution via incomplete path sanitization
CVE: CVE-2026-26157
Component: busybox
CWE: CWE-73
Severity: Important
CVSS v3: 6.9/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-11T00:00:00+00:00

A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.


Remediation:
As a prevention measure, avoid extracting archives from untrusted sources using BusyBox utilities. If extraction of untrusted archives is necessary, perform it within a highly isolated and restricted environment, such as a container with a read-only root filesystem and minimal privileges, to limit the potential impact of arbitrary file overwrites.
Vaultwarden: Information disclosure due to bypassed collection permissions
CVE: CVE-2026-26012
Component: vaultwarden
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-02-11T21:14:58.102000+00:00

A flaw was found in vaultwarden, an unofficial Bitwarden compatible server. A regular organization member can retrieve all ciphers (encrypted data) within an organization, bypassing collection-level access controls. This allows for unauthorized information disclosure, potentially exposing sensitive data.

Statement: MODERATE: This flaw allows an authenticated organization member to bypass collection permissions and enumerate all ciphers within a Vaultwarden organization. This could lead to unauthorized disclosure of sensitive information. Red Hat does not ship Vaultwarden as part of its products; however, customers deploying Vaultwarden in their environment may be affected.

Remediation:
Unredacted data exposure in query.log
CVE: CVE-2026-1622
Component: neo4j
CWE: CWE-532
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-02-04T09:14:46.320000+00:00

A flaw was found in Neo4j. The obfuscate_literals option in the query logs fails to extend redaction to error messages. When a query triggers an error, unredacted data, potentially containing sensitive literals, are exposed in the logs. This issue allows an attacker with access to the local log files to obtain sensitive information they are not authorized to view, resulting in an information leak.

Statement: To exploit this issue, an attacker must have access to the local log files. Permission to run queries facilitates exploitation but access is essential to view exposed data. Due to this reason, this vulnerability has been rated with a moderate severity.

Remediation:
To mitigate this issue, restrict log file access at the operating system level. Ensure that access to the disk location where query.log (and other logs) are stored is strictly limited to authorized system administrators.
Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild
CVE: CVE-2026-23210
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's ice network driver. A local attacker could exploit a race condition during the Virtual Station Interface (VSI) rebuild process. This flaw occurs when the Precision Time Protocol (PTP) periodic work attempts to access uninitialized memory, leading to a NULL pointer dereference. Successful exploitation results in a system crash, causing a Denial of Service (DoS).


Remediation:
To mitigate this vulnerability, prevent the `ice` kernel module from loading. This can be achieved by creating a blacklist file for the module.

1. Create a file named `/etc/modprobe.d/blacklist-ice.conf` with the following content:
   `blacklist ice`

2. Regenerate the initramfs to ensure the blacklist is applied during boot:
   `dracut -f -v`

3. Reboot the system for the changes to take effect.

Warning: Blacklisting the `ice` module may impact network functionality if your system relies on network devices using this driver. Ensure this action is compatible with your system's requirements before proceeding.
ImageMagick: Denial of service and potential arbitrary code execution via integer overflow in image processing
CVE: CVE-2026-25794
Component: ImageMagick
CWE: CWE-190
Severity: Important
CVSS v3: 8.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Release date: 2026-02-24T00:53:23.396000+00:00

A flaw was found in ImageMagick. When processing images with large dimensions, the `WriteUHDRImage` function in `coders/uhdr.c` uses integer arithmetic that can overflow. This overflow leads to an undersized memory allocation, followed by an out-of-bounds write. A remote attacker could exploit this vulnerability by providing a specially crafted image, potentially causing a denial of service or, in some cases, arbitrary code execution.

Statement: This IMPORTANT heap-buffer-overflow vulnerability in ImageMagick's `WriteUHDRImage` function can lead to a denial of service or potentially arbitrary code execution when processing specially crafted UHDR images with excessively large dimensions. Red Hat Enterprise Linux 6 ELS and 7 ELS are affected by this flaw, which occurs due to a signed integer overflow during pixel buffer size calculation.

Remediation:
To mitigate this vulnerability, avoid processing untrusted or maliciously crafted UHDR image files with ImageMagick. Limiting the exposure of ImageMagick to untrusted input can reduce the risk of exploitation.
netfilter: nf_conncount: update last_gc only when GC has been performed
CVE: CVE-2026-23139
Component: kernel
CWE: CWE-400
Severity: Moderate
CVSS v3: 7.8/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conncount: update last_gc only when GC has been performed

Currently last_gc is being updated everytime a new connection is
tracked, that means that it is updated even if a GC wasn't performed.
With a sufficiently high packet rate, it is possible to always bypass
the GC, causing the list to grow infinitely.

Update the last_gc value only when a GC has been actually performed.

Statement: A denial of service condition can occur in the netfilter nf_conncount implementation due to incorrect tracking of the last garbage collection timestamp. The nf_conncount code maintains per bucket accounting lists and uses last_gc to decide when it should perform garbage collection of stale entries. Before this change, last_gc was updated every time a new connection 
entry was tracked. This meant the timestamp could be refreshed even when garbage collection did not actually run. Under a sufficiently high rate of new connections, an attacker can continuously refresh last_gc and effectively keep the code from ever triggering the real GC path. The result is unbounded growth of the internal conncount list, causing increased CPU overhead and eventually memory exhaustion leading to kernel level denial of service.

Remediation:
Integer overflow in ANGLE
CVE: CVE-2026-3536
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-03T00:00:00+00:00

Integer overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
mongo-c-driver: Denial of Service via malformed HTTP response
CVE: CVE-2026-4359
Component: mongo-c-driver
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-17T19:42:03.476000+00:00

A flaw was found in mongo-c-driver. A compromised third-party cloud server or a man-in-the-middle (MITM) attacker could send a malformed HTTP response. This could cause applications using the MongoDB C driver to crash, leading to a Denial of Service.

Statement: This LOW impact vulnerability in the MongoDB C driver allows denial of service via malformed HTTP responses. Exploitation requires high complexity—either a compromised cloud server or active MITM position. Impact is limited to availability. Applications are only vulnerable when connecting to untrusted MongoDB instances or over untrusted networks.

Remediation:
ksmbd: smbd: fix dma_unmap_sg() nents
CVE: CVE-2026-23093
Component: kernel
Severity: None
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: smbd: fix dma_unmap_sg() nents

The dma_unmap_sg() functions should be called with the same nents as the
dma_map_sg(), not the value the map function returned.


Remediation:
markdown-it: Denial of Service via Regular Expression Denial of Service in linkify function
CVE: CVE-2026-2327
Component: markdown-it
CWE: CWE-1333
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-12T05:00:07.369000+00:00

A flaw was found in markdown-it. A remote attacker can exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted input containing a long sequence of asterisk characters followed by a non-matching character to the `linkify` function. This triggers excessive backtracking in the regular expression, leading to a denial-of-service condition.


Remediation:
thunderbird: Privilege escalation in the Messaging System component
CVE: CVE-2026-2777
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:12.869000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Privilege escalation in the Messaging System component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Wasmtime: Denial of Service via repeated async function calls
CVE: CVE-2026-27195
Component: wasmtime
CWE: CWE-248
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-24T21:15:20.366000+00:00

Wasmtime is a runtime for WebAssembly. Starting with Wasmtime 39.0.0, the `component-model-async` feature became the default, which brought with it a new implementation of `[Typed]Func::call_async` which made it capable of calling async-typed guest export functions.  However, that implementation had a bug leading to a panic under certain circumstances: First, the host embedding calls `[Typed]Func::call_async` on a function exported by a component, polling the returned `Future` once. Second, the component function yields control to the async runtime (e.g. Tokio), e.g. due to a call to host function registered using `LinkerInstance::func_wrap_async` which yields, or due an epoch interruption. Third, the host embedding drops the `Future` after polling it once.  This leaves the component instance in a non-reenterable state since the call never had a chance to complete. Fourth, the host embedding calls `[Typed]Func::call_async` again, polling the returned `Future`.  Since the component instance cannot be entered at this point, the call traps, but not before allocating a task and thread for the call. Fifth, the host embedding ignores the trap and drops the `Future`.  This panics due to the runtime attempting to dispose of the task created above, which panics since the thread has not yet exited. When a host embedder using the affected versions of Wasmtime calls `wasmtime::component::[Typed]Func::call_async` on a guest export and then drops the returned future without waiting for it to resolve, and then does so again with the same component instance, Wasmtime will panic. Embeddings that have the `component-model-async` compile-time feature disabled are unaffected. Wasmtime 40.0.4 and 41.0.4 have been patched to fix this issue. Versions 42.0.0 and later are not affected. If an embedding is not actually using any component-model-async features then disabling the `component-model-async` Cargo feature can work around this issue. This issue can also be worked around by either ensuring every `call_async` future is awaited until it completes or refraining from using the `Store` again after dropping a not-yet-resolved `call_async` future.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
thunderbird: Use-after-free in the DOM: Core & HTML component
CVE: CVE-2026-2798
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:28.034000+00:00

Use-after-free in the DOM: Core & HTML component. This vulnerability affects Firefox < 148 and Thunderbird < 148.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Out of bounds memory access in WebML
CVE: CVE-2026-3920
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-10T00:00:00+00:00

An out of bounds memory access flaw was found in the WebML component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=482875307

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
improper handling of case sensitivity
CVE: CVE-2026-27896
Component: modelcontextprotocol/go-sdk
CWE: CWE-178
Severity: Important
CVSS v3: 7.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Release date: 2026-02-26T00:47:46.967000+00:00

A flaw was found in the Go MCP SDK. This issue occurs due to an improper handling of case sensitivity during JSON-RPC message parsing, specifically in the matching of JSON keys to struct field tags. This behavior violates the JSON-RPC 2.0 specification, which explicitly requires case-sensitive field name matching. A malicious MCP peer able to send protocol messages with non-standard field casing can potentially bypass intermediary inspection, allowing attackers to smuggle payloads past upstream filters and cause cross-implementation inconsistency.

Statement: This issue is only exploitable in MCP Go SDK backends deployed behind an intermediary security control, like a WAF, inspection proxy or strict firewall that enforces the JSON-RPC 2.0 specification. This vulnerability allows an attacker to bypass the upstream filter and deliver a message to the backend. However, the attacker is still constrained by the normal business logic of the application and cannot cause memory access, arbitrary command execution or grant database administrative rights. Due to these reasons, this flaw has been rated with an important severity.

Remediation:
To mitigate this flaw, strictly enforce JSON-RPC case sensitivity before payload processing or harden upstream WAF and proxy rules to explicitly block improperly cased requests at the network edge.
quickjs-ng: Heap-based buffer overflow in js_typed_array_sort function
CVE: CVE-2026-0822
Component: quickjs-ng
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2026-01-10T13:32:08.881000+00:00

A flaw was found in quickjs-ng. A remote attacker could exploit a heap-based buffer overflow vulnerability by manipulating the `js_typed_array_sort` function in `quickjs.c`. This could lead to information disclosure, denial of service, or potentially arbitrary code execution. An exploit for this vulnerability is publicly available.

Statement: This vulnerability is rated Moderate for Red Hat. A heap-based buffer overflow in the `js_typed_array_sort` function of `quickjs.c` in `quickjs-ng` can be exploited remotely with user interaction. This flaw could lead to information disclosure, denial of service, or arbitrary code execution in affected Red Hat Community Projects, such as `radare2` in EPEL and Fedora.

Remediation:
GLib: Denial of Service via Integer Overflow in g_buffered_input_stream_peek()
CVE: CVE-2026-0988
Component: glib
CWE: CWE-190
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-01-15T00:00:00+00:00

A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS).

Statement: This vulnerability is rated Moderate for Red Hat. An integer overflow in the `g_buffered_input_stream_peek()` function of the GLib library can lead to a Denial of Service. Exploitation requires specially crafted input and is subject to strict preconditions, primarily causing application crashes.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.