huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
bcachefs: bch2_ioctl_subvolume_destroy() fixes
CVE: CVE-2025-22019
Component: kernel
Severity: None
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bcachefs: bch2_ioctl_subvolume_destroy() fixes

bch2_evict_subvolume_inodes() was getting stuck - due to incorrectly
pruning the dcache.

Also, fix missing permissions checks.


Remediation:
rust_binder: remove spin_lock() in rust_shrink_free_page()
CVE: CVE-2025-71181
Component: kernel
Severity: None
Release date: 2025-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

rust_binder: remove spin_lock() in rust_shrink_free_page()

When forward-porting Rust Binder to 6.18, I neglected to take commit
fb56fdf8b9a2 ("mm/list_lru: split the lock to per-cgroup scope") into
account, and apparently I did not end up running the shrinker callback
when I sanity tested the driver before submission. This leads to crashes
like the following:

	============================================
	WARNING: possible recursive locking detected
	6.18.0-mainline-maybe-dirty #1 Tainted: G          IO
	--------------------------------------------
	kswapd0/68 is trying to acquire lock:
	ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: lock_list_lru_of_memcg+0x128/0x230

	but task is already holding lock:
	ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: rust_helper_spin_lock+0xd/0x20

	other info that might help us debug this:
	 Possible unsafe locking scenario:

	       CPU0
	       ----
	  lock(&l->lock);
	  lock(&l->lock);

	 *** DEADLOCK ***

	 May be due to missing lock nesting notation

	3 locks held by kswapd0/68:
	 #0: ffffffff90d2e260 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x597/0x1160
	 #1: ffff956000fa18b0 (&l->lock){+.+.}-{2:2}, at: rust_helper_spin_lock+0xd/0x20
	 #2: ffffffff90cf3680 (rcu_read_lock){....}-{1:2}, at: lock_list_lru_of_memcg+0x2d/0x230

To fix this, remove the spin_lock() call from rust_shrink_free_page().


Remediation:
CVE: CVE-2025-5825
Component: Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability
Release date: 2025-06-11T17:27:15.633000+00:00

Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.

The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a firmware image before using it to perform an upgrade. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device. Was ZDI-CAN-26354.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
h11 accepts some malformed Chunked-Encoding bodies
CVE: CVE-2025-43859
Component: h11
CWE: CWE-444
Severity: Important
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2025-04-24T18:15:53.328000+00:00

A flaw was found in the h11. This vulnerability allows request smuggling via improper parsing of chunked-coding message bodies, where h11 fails to validate the required \r\n terminators.


Remediation:
Red Hat Ansible Automation Platform
Red Hat Ansible Automation Platform
Ensure any applications using h11 are behind a correctly configured reverse proxy will prevent exploitation of this flaw.
Apache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error message
CVE: CVE-2025-30474
Component: apache-commons-vfs
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-03-23T14:15:51.339000+00:00

A flaw was found in Apache Commons VFS. The `FtpFileObject` class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Undefined Behavior Due to Out-of-Bounds Pointer Arithmetic in libwebsockets
CVE: CVE-2025-1866
Component: libwebsockets
CWE: CWE-119
Severity: Important
CVSS v3: 8.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-03-03T08:44:23.118000+00:00

A flaw was found in warmcat libwebsockets. This vulnerability allows pointer manipulation, potentially leading to out-of-bounds memory access via specific CMake configurations on the Win32 platform.

Statement: No Red Hat products are affected by this vulnerability.

Although the affected code path is gated behind non-default CMake options, this vulnerability marked as important severity due to the nature of the flaw—pointer manipulation leading to out-of-bounds memory access. When triggered, it can allow an attacker to corrupt memory outside the intended bounds, which is a classic primitive for exploiting memory safety bugs. On platforms like Win32, where traditional memory protections may vary or be less robust than on hardened Unix-like systems, such vulnerabilities can facilitate control flow hijacking or arbitrary code execution if combined with other memory layout knowledge or information disclosure bugs.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
media: cx231xx: set device_caps for 417
CVE: CVE-2025-38044
Component: kernel
CWE: CWE-99
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: cx231xx: set device_caps for 417

The video_device for the MPEG encoder did not set device_caps.

Add this, otherwise the video device can't be registered (you get a
WARN_ON instead).

Not seen before since currently 417 support is disabled, but I found
this while experimenting with it.


Remediation:
rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy
CVE: CVE-2025-21635
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy

As mentioned in a previous commit of this series, using the 'net'
structure via 'current' is not recommended for different reasons:

- Inconsistency: getting info from the reader's/writer's netns vs only
  from the opener's netns.

- current->nsproxy can be NULL in some cases, resulting in an 'Oops'
  (null-ptr-deref), e.g. when the current task is exiting, as spotted by
  syzbot [1] using acct(2).

The per-netns structure can be obtained from the table->data using
container_of(), then the 'net' one can be retrieved from the listen
socket (if available).


Remediation:
NFSD: Define actions for the new time_deleg FATTR4 attributes
CVE: CVE-2025-40326
Component: kernel
CWE: CWE-1287
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-08T00:00:00+00:00

A denial of service vulnerability was found in the NFS server (NFSD) in the Linux kernel. The server lacks handlers for the new time_deleg FATTR4 attributes introduced in RFC 9754. If a client sends a GETATTR request for these attributes, NFSD crashes instead of returning an appropriate error.

Statement: NFSv4 clients should not send GETATTR for these attributes per the specification, so only malicious or non-compliant clients would trigger this. The fix returns nfserr_inval for such requests.

Remediation:
PostgreSQL code execution in restore operation
CVE: CVE-2025-8714
Component: postgresql
CWE: CWE-829
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-08-14T13:00:07.046000+00:00

A flaw was found in PostgreSQL. This vulnerability allows a malicious superuser on a PostgreSQL server to inject arbitrary code into dump files created by pg_dump, pg_dumpall, and pg_restore, causing arbitrary code execution on the client machine when these dump files are restored by psql due to untrusted data inclusion.

Statement: To exploit this flaw, a PostgreSQL user with special privileges needs to inject arbitrary code in a dump file. The malicious code will only be executed on the client machine when a user restore the crafted dump file. Due to these reasons, this vulnerability has been rated with an Important severity.

Additionally, pg_restore is affected only when used to generate a plain-format dump.

Remediation:
Do not restore a dump file from a server or user you do not explicitly trust.
Kernel: Denial of Service in ath12k Wi-Fi driver due to incorrect register definition
CVE: CVE-2025-38414
Component: kernel
CWE: CWE-455
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850

GCC_GCC_PCIE_HOT_RST is wrongly defined for WCN7850, causing kernel crash
on some specific platforms.

Since this register is divergent for WCN7850 and QCN9274, move it to
register table to allow different definitions. Then correct the register
address for WCN7850 to fix this issue.

Note IPQ5332 is not affected as it is not PCIe based device.

Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3


Remediation:
MediaWiki: Information disclosure via block list handling
CVE: CVE-2025-6927
Component: MediaWiki
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in MediaWiki, specifically within the handling of block lists via `BlockListPager.Php` and `ApiQueryBlocks.Php`. A remote attacker could exploit this vulnerability with user interaction to achieve low confidentiality impact, potentially disclosing limited information related to block lists.

Statement: The impact of this vulnerability is LOW. Autoblocks originating from global account suppressions in MediaWiki are publicly exposed. This information disclosure affects MediaWiki versions from 1.42.0 before 1.39.13, 1.42.7, 1.43.2, and 1.44.0.

Remediation:
Traefik Path Normalization Bypass in Router + Middleware Rules
CVE: CVE-2025-66490
Component: github.com/traefik/traefik
CWE: CWE-436
Severity: Important
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2025-12-09T00:35:26.530000+00:00

Traefik is an HTTP reverse proxy and load balancer. For versions prior to 2.11.32 and 2.11.31 through 3.6.2, requests using PathPrefix, Path or PathRegex matchers can bypass path normalization. When Traefik uses path-based routing, requests containing URL-encoded restricted characters (/, \, Null, ;, ?, #) can bypass the middleware chain and reach unintended backends. For example, a request to http://mydomain.example.com/admin%2F could reach service-a without triggering my-security-middleware, bypassing security controls for the /admin/ path. This issue is fixed in versions 2.11.32 and 3.6.3.


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Erlang Excessive Use of System Resources
CVE: CVE-2025-48038
Component: erlang
CWE: CWE-770
Severity: Moderate
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-09-11T08:13:04.030000+00:00

A resource exhaustion flaw has been discovered in the Erlang OTP. Unverified file handles from authenticated SFTP users can lead to excessive CPU and memory usage, potentially affecting system stability.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error
CVE: CVE-2025-39878
Component: kernel
Severity: None
Release date: 2025-09-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error

The function move_dirty_folio_in_page_array() was created by commit
ce80b76dd327 ("ceph: introduce ceph_process_folio_batch() method") by
moving code from ceph_writepages_start() to this function.

This new function is supposed to return an error code which is checked
by the caller (now ceph_process_folio_batch()), and on error, the
caller invokes redirty_page_for_writepage() and then breaks from the
loop.

However, the refactoring commit has gone wrong, and it by accident, it
always returns 0 (= success) because it first NULLs the pointer and
then returns PTR_ERR(NULL) which is always 0.  This means errors are
silently ignored, leaving NULL entries in the page array, which may
later crash the kernel.

The simple solution is to call PTR_ERR() before clearing the pointer.


Remediation:
Heap Buffer Overflow in libbpf
CVE: CVE-2025-29481
Component: libbpf
CWE: CWE-122
Severity: Moderate
CVSS v3: 7.5/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Release date: 2025-04-07T00:00:00+00:00

A flaw was found in libbpf. This vulnerability allows a local attacker to execute arbitrary code or cause a denial of service (crash) via a crafted ELF file that triggers a heap buffer overflow.

Statement: This vulnerability is rated as a moderate severity because here heap buffer overflow vulnerability exists in the bpf_object__init_prog function of libbpf where this issue occurs due to missing boundary checks when copying BPF instructions from a malformed ELF file leading to memory corruption during memcpy and the impact of the issue is a crash of the application using libbpf when it loads a malicious BPF object file, the overflow could allow limited memory corruption.

Remediation:
Incus vulnerable to local privilege escalation through custom storage volumes
CVE: CVE-2025-64507
Component: Incus
CVSS v3: 8.4/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-11-10T21:56:26.578000+00:00

An issue in Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the `security.shifted` property set to `true` as well as access to the host as an unprivileged user. The most common case for this would be systems using `incus-user` with the less privileged `incus` group to provide unprivileged users with an isolated restricted access to Incus. Such users may be able to create a custom storage volume with the necessary property (depending on kernel and filesystem support) and can then write a setuid binary from within the container which can be executed as an unprivileged user on the host to gain root privileges.

Statement: The vulnerability in Incus allows a local unprivileged user to escalate privileges to root on the host system. This occurs when an unprivileged user has root access to a container with a custom storage volume that has the `security.shifted` property set to `true`, and also has unprivileged access to the host. Exploitation requires these specific conditions to be met.

Remediation:
CVE: CVE-2025-7265
Component: IrfanView CADImage Plugin CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Release date: 2025-07-08T19:57:33.645000+00:00

IrfanView CADImage Plugin CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26173.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
wifi: ath12k: fix node corruption in ar->arvifs list
CVE: CVE-2025-38290
Component: kernel
CWE: CWE-672
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix node corruption in ar->arvifs list

In current WLAN recovery code flow, ath12k_core_halt() only reinitializes
the "arvifs" list head. This will cause the list node immediately following
the list head to become an invalid list node. Because the prev of that node
still points to the list head "arvifs", but the next of the list head
"arvifs" no longer points to that list node.

When a WLAN recovery occurs during the execution of a vif removal, and it
happens before the spin_lock_bh(&ar->data_lock) in
ath12k_mac_vdev_delete(), list_del() will detect the previously mentioned
situation, thereby triggering a kernel panic.

The fix is to remove and reinitialize all vif list nodes from the list head
"arvifs" during WLAN halt. The reinitialization is to make the list nodes
valid, ensuring that the list_del() in ath12k_mac_vdev_delete() can execute
normally.

Call trace:
__list_del_entry_valid_or_report+0xd4/0x100 (P)
ath12k_mac_remove_link_interface.isra.0+0xf8/0x2e4 [ath12k]
ath12k_scan_vdev_clean_work+0x40/0x164 [ath12k]
cfg80211_wiphy_work+0xfc/0x100
process_one_work+0x164/0x2d0
worker_thread+0x254/0x380
kthread+0xfc/0x100
ret_from_fork+0x10/0x20

The change is mostly copied from the ath11k patch:
https://lore.kernel.org/all/20250320053145.3445187-1-quic_stonez@quicinc.com/

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1

Statement: A race condition in the Qualcomm ath12k wireless driver could lead to a kernel panic when WLAN recovery occurs during interface (vif) deletion. The root cause is improper reinitialization of the ar->arvifs linked list - specifically, only the list head was reset while stale nodes remained, creating an invalid list state. This results in a corrupted list during list_del(), triggering __list_del_entry_valid_or_report(). The issue is fixed by safely deleting and reinitializing all list nodes under a lock in ath12k_core_halt().

Remediation:
iommu/vt-d: Disallow dirty tracking if incoherent page walk
CVE: CVE-2025-40058
Component: kernel
CWE: CWE-119
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Release date: 2025-10-28T00:00:00+00:00

A flaw was found in the Intel VT-d IOMMU support in the Linux kernel. When an IOMMU is configured to perform dirty-page tracking, but the page-walk memory region is incoherent between the IOMMU and CPU, the hardware may attempt to atomically update the bits in a paging-structure entry that is not properly snooped. The resulting fault could lead to a system hang and a non-recoverable state.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria, comprising ease of use and deployment, applicability to widespread installation base or stability.
libsodium: Cryptographic bypass via improper elliptic curve point validation
CVE: CVE-2025-15444
Component: libsodium
CWE: CWE-1395
Severity: Moderate
CVSS v3: 7.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in libsodium, a cryptographic library used for secure communication. When processing certain custom cryptographic data or untrusted inputs, the library's `crypto_core_ed25519_is_valid_point` function incorrectly validates elliptic curve points. This oversight could allow an attacker to bypass cryptographic security measures, potentially compromising the confidentiality and integrity of sensitive data.

Statement: This vulnerability is rated Moderate for Red Hat products as it affects the libsodium cryptographic library. The flaw in `crypto_core_ed25519_is_valid_point` allows for cryptographic bypass in atypical use cases involving custom cryptography or untrusted data. This could compromise the confidentiality and integrity of sensitive data in affected Red Hat OpenStack Platform, Red Hat Developer Hub, and Red Hat Satellite deployments.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
x86/xen: fix xen_hypercall_hvm() to not clobber %rbx
CVE: CVE-2025-21818
Component: kernel
CWE: CWE-20
Severity: None
Release date: 2025-02-27T00:00:00+00:00

[REJECTED CVE] In the Linux kernel, the following vulnerability has been resolved:

x86/xen: fix xen_hypercall_hvm() to not clobber %rbx

xen_hypercall_hvm(), which is used when running as a Xen PVH guest at
most only once during early boot, is clobbering %rbx. Depending on
whether the caller relies on %rbx to be preserved across the call or
not, this clobbering might result in an early crash of the system.

Statement: This CVE has been marked as Rejected by the assigning CNA.

Remediation:
mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show()
CVE: CVE-2025-37866
Component: kernel
Severity: None
Release date: 2025-05-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show()

A warning is seen when running the latest kernel on a BlueField SOC:
[251.512704] ------------[ cut here ]------------
[251.512711] invalid sysfs_emit: buf:0000000003aa32ae
[251.512720] WARNING: CPU: 1 PID: 705264 at fs/sysfs/file.c:767 sysfs_emit+0xac/0xc8

The warning is triggered because the mlxbf-bootctl driver invokes
"sysfs_emit()" with a buffer pointer that is not aligned to the
start of the page. The driver should instead use "sysfs_emit_at()"
to support non-zero offsets into the destination buffer.


Remediation: