huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Linux kernel: Denial of Service due to unsafe xarray access in RDMA/mlx5
CVE: CVE-2025-38372
Component: kernel
CWE: CWE-413
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling

__xa_store() and __xa_erase() were used without holding the proper lock,
which led to a lockdep warning due to unsafe RCU usage.  This patch
replaces them with xa_store() and xa_erase(), which perform the necessary
locking internally.

  =============================
  WARNING: suspicious RCPU usage
  6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1 Not tainted
  -----------------------------
  ./include/linux/xarray.h:1211 suspicious rcu_dereference_protected() usage!

  other info that might help us debug this:

  rcu_scheduler_active = 2, debug_locks = 1
  3 locks held by kworker/u136:0/219:
      at: process_one_work+0xbe4/0x15f0
      process_one_work+0x75c/0x15f0
      pagefault_mr+0x9a5/0x1390 [mlx5_ib]

  stack backtrace:
  CPU: 14 UID: 0 PID: 219 Comm: kworker/u136:0 Not tainted
  6.14.0-rc7_for_upstream_debug_2025_03_18_15_01 #1
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
  rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
  Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib]
  Call Trace:
   dump_stack_lvl+0xa8/0xc0
   lockdep_rcu_suspicious+0x1e6/0x260
   xas_create+0xb8a/0xee0
   xas_store+0x73/0x14c0
   __xa_store+0x13c/0x220
   ? xa_store_range+0x390/0x390
   ? spin_bug+0x1d0/0x1d0
   pagefault_mr+0xcb5/0x1390 [mlx5_ib]
   ? _raw_spin_unlock+0x1f/0x30
   mlx5_ib_eqe_pf_action+0x3be/0x2620 [mlx5_ib]
   ? lockdep_hardirqs_on_prepare+0x400/0x400
   ? mlx5_ib_invalidate_range+0xcb0/0xcb0 [mlx5_ib]
   process_one_work+0x7db/0x15f0
   ? pwq_dec_nr_in_flight+0xda0/0xda0
   ? assign_work+0x168/0x240
   worker_thread+0x57d/0xcd0
   ? rescuer_thread+0xc40/0xc40
   kthread+0x3b3/0x800
   ? kthread_is_per_cpu+0xb0/0xb0
   ? lock_downgrade+0x680/0x680
   ? do_raw_spin_lock+0x12d/0x270
   ? spin_bug+0x1d0/0x1d0
   ? finish_task_switch.isra.0+0x284/0x9e0
   ? lockdep_hardirqs_on_prepare+0x284/0x400
   ? kthread_is_per_cpu+0xb0/0xb0
   ret_from_fork+0x2d/0x70
   ? kthread_is_per_cpu+0xb0/0xb0
   ret_from_fork_asm+0x11/0x20


Remediation:
Incorrect boundary conditions in the Graphics: WebGPU component
CVE: CVE-2025-13022
Component: firefox
CWE: CWE-787
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-11-11T15:47:13.605000+00:00

Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability affects Firefox < 145 and Thunderbird < 145.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Inappropriate implementation in Payments
CVE: CVE-2025-0442
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-01-15T10:58:53.903000+00:00

Inappropriate implementation in Payments in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
iommufd: Prevent ALIGN() overflow
CVE: CVE-2025-38688
Component: kernel
CWE: CWE-190
Severity: Moderate
CVSS v3: 6.3/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Release date: 2025-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Prevent ALIGN() overflow

When allocating IOVA the candidate range gets aligned to the target
alignment. If the range is close to ULONG_MAX then the ALIGN() can
wrap resulting in a corrupted iova.

Open code the ALIGN() using get_add_overflow() to prevent this.
This simplifies the checks as we don't need to check for length earlier
either.

Consolidate the two copies of this code under a single helper.

This bug would allow userspace to create a mapping that overlaps with some
other mapping or a reserved range.


Remediation:
Crafted email message incorrectly shown as being encrypted
CVE: CVE-2025-26696
Component: thunderbird
CWE: CWE-451
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-03-10T18:41:25.205000+00:00

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
HDF5 Metadata Attribute Decoder H5MM_strndup heap-based overflow
CVE: CVE-2025-2310
Component: HDF5
CWE: CWE-122
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-03-14T21:00:09.852000+00:00

A vulnerability was found in HDF5. This issue affects the function H5MM_strndup of the component Metadata Attribute Decoder. Manipulation leads to a heap-based buffer overflow.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Denial of service via crafted DoH exchange in PowerDNS DNSdist
CVE: CVE-2025-30187
Component: DNSdist
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-09-18T09:21:32.274000+00:00

A flaw was found in DNSdist. When DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, a specially crafted DoH (DNS-over-HTTPS) exchange can cause an unbound I/O read loop and result in an unexpected consumption of CPU resources.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
messagelib: Spoofing of threat data due to ignored SSL errors
CVE: CVE-2025-69412
Component: messagelib
CVSS v3: 3.3/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Release date: 2025-12-31T23:20:55.785000+00:00

A flaw was found in messagelib. This vulnerability allows a remote attacker to spoof threat data by exploiting the component's failure to properly validate SSL certificates when communicating with the Google Safe Browsing Lookup API. This could lead to malicious content bypassing security checks. This issue only affects configurations where the Google Safe Browsing Lookup API is explicitly enabled, as it is not contacted in the default setup.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
smb/server: fix possible refcount leak in smb2_sess_setup()
CVE: CVE-2025-40285
Component: kernel
Severity: None
Release date: 2025-12-06T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

smb/server: fix possible refcount leak in smb2_sess_setup()

Reference count of ksmbd_session will leak when session need reconnect.
Fix this by adding the missing ksmbd_user_session_put().


Remediation:
neqo-transport panic
CVE: CVE-2025-6703
Component: neqo-transport
CWE: CWE-20
Severity: Low
CVSS v3: 3.7/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-06-26T09:30:03.893000+00:00

A packet size handling flaw has been discovered in neqo-transport. If a server is prompted to send a packet larger than the maximum variant allowed, it will attempt to do so and panic, resulting in a program crash.

Statement: The impact for this vulnerability in neqo-transport is rated as a low for Red Hat products as the denial of service is limited to the process using neqo-transport and not to the broader system.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
dmaengine: lpc18xx-dmamux: fix device leak on route allocation
CVE: CVE-2025-71188
Component: kernel
Severity: None
Release date: 2025-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: lpc18xx-dmamux: fix device leak on route allocation

Make sure to drop the reference taken when looking up the DMA mux
platform device during route allocation.

Note that holding a reference to a device does not prevent its driver
data from going away so there is no point in keeping the reference.


Remediation:
RDMA/hns: Fix soft lockup during bt pages loop
CVE: CVE-2025-22010
Component: kernel
CWE: CWE-606
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

RDMA/hns: Fix soft lockup during bt pages loop

Driver runs a for-loop when allocating bt pages and mapping them with
buffer pages. When a large buffer (e.g. MR over 100GB) is being allocated,
it may require a considerable loop count. This will lead to soft lockup:

        watchdog: BUG: soft lockup - CPU#27 stuck for 22s!
        ...
        Call trace:
         hem_list_alloc_mid_bt+0x124/0x394 [hns_roce_hw_v2]
         hns_roce_hem_list_request+0xf8/0x160 [hns_roce_hw_v2]
         hns_roce_mtr_create+0x2e4/0x360 [hns_roce_hw_v2]
         alloc_mr_pbl+0xd4/0x17c [hns_roce_hw_v2]
         hns_roce_reg_user_mr+0xf8/0x190 [hns_roce_hw_v2]
         ib_uverbs_reg_mr+0x118/0x290

        watchdog: BUG: soft lockup - CPU#35 stuck for 23s!
        ...
        Call trace:
         hns_roce_hem_list_find_mtt+0x7c/0xb0 [hns_roce_hw_v2]
         mtr_map_bufs+0xc4/0x204 [hns_roce_hw_v2]
         hns_roce_mtr_create+0x31c/0x3c4 [hns_roce_hw_v2]
         alloc_mr_pbl+0xb0/0x160 [hns_roce_hw_v2]
         hns_roce_reg_user_mr+0x108/0x1c0 [hns_roce_hw_v2]
         ib_uverbs_reg_mr+0x120/0x2bc

Add a cond_resched() to fix soft lockup during these loops. In order not
to affect the allocation performance of normal-size buffer, set the loop
count of a 100GB MR as the threshold to call cond_resched().


Remediation:
Apache Tomcat: Security constraint bypass for CGI scripts
CVE: CVE-2025-46701
Component: tomcat
CWE: CWE-178
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2025-05-29T19:06:04.289000+00:00

A flaw was found in the CGI servlet component of Apache Tomcat. This vulnerability allows a security constraint bypass via improper handling of case sensitivity in the pathInfo component of a URI mapped to the CGI servlet.

Statement: This vulnerability is rated Moderate rather than Important due to several limiting technical factors that reduce its overall impact and exploitability. Firstly, the flaw only manifests on case-insensitive file systems (e.g., Windows NTFS or macOS HFS+), which are less common in production-grade Tomcat deployments, most of which run on case-sensitive Linux file systems. Secondly, the bypass only occurs when security constraints are defined specifically on the pathInfo portion of URLs mapped to the CGI servlet — a relatively uncommon and niche configuration in modern Tomcat-based applications, where URL-based access control tends to use more direct patterns or broader filters. Additionally, successful exploitation does not lead to remote code execution or denial of service, but rather circumvents access control under specific conditions.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.

The References section of this erratum contains a download link for the update. You must be logged in to download the update.
Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.
Keycloak hostname verification
CVE: CVE-2025-3501
Component: org.keycloak.protocol.services
CWE: CWE-297
Severity: Important
CVSS v3: 8.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Release date: 2025-04-29T00:00:00+00:00

A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended.

Statement: Red Hat has rated this as an Important severity, although this configuration is not recommended, especially in production environments.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Use the correct TLS configuration and avoid using "--tls-hostname-verifier=any".
NULL pointer dereference in  soup_message_headers_get_content_disposition when "filename" parameter  is present, but has no value in Content-Disposition header
CVE: CVE-2025-32913
Component: libsoup
CWE: CWE-476
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-14T00:00:00+00:00

A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to crash a libsoup client or server that uses this function.


Remediation:
Currently, no mitigation is available for this vulnerability.
Sinatra has ReDoS vulnerability in ETag header value generation
CVE: CVE-2025-61921
Component: sinatra
CWE: CWE-1333
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-10-10T19:28:10.688000+00:00

A flaw was found in Sinatra. A Regular Expression Denial of Service (ReDoS) vulnerability can be triggered when parsing the If-Match and If-None-Match HTTP headers. A remote attacker can exploit this issue by sending a specially crafted header to an application endpoint that uses the etag method, causing a excessive CPU consumption and potentially resulting in a denial of service.

Statement: This flaw can only be exploited in applications using the etag method to generate a response and if they are using Ruby below version 3.2, limiting the exposure of this issue.

The most likely security impact of this vulnerability is an unexpected amount of time to parse the If-Match and If-None-Match HTTP headers, potentially resulting in a degraded application performance but not completely deny service to legitimate users. Due to this reason, this flaw has been rated with a moderate severity.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
libssh: Insecure default configuration leads to local man-in-the-middle attacks on Windows
CVE: CVE-2025-14821
Component: libssh
CWE: CWE-427
Severity: Low
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an insecure default configuration on Windows systems where the library automatically loads configuration files from the C:\etc directory, which can be created and modified by unprivileged local users.

Statement: This vulnerability is rated Low for Red Hat products. The flaw in libssh is specific to its insecure default configuration on Windows systems, where it loads configuration from the C:\etc directory. Red Hat's Linux-based products do not utilize this configuration path, and therefore are not affected by this vulnerability.

Remediation:
drm/amdgpu: fix lock warning in amdgpu_userq_fence_driver_process
CVE: CVE-2025-68203
Component: kernel
Severity: None
Release date: 2025-12-16T00:00:00+00:00

No description is available for this CVE.


Remediation:
Mitigation bypass in the Web Compatibility: Tooling component
CVE: CVE-2025-10531
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-09-16T12:26:38.264000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue:Mitigation bypass in the Web Compatibility: Tooling component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links
CVE: CVE-2025-5986
Component: thunderbird
CWE: CWE-400
Severity: Important
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-06-10T00:00:00+00:00

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
CVE: CVE-2025-6646
Component: PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability
Release date: 2025-06-25T21:33:26.091000+00:00

PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26643.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
iio: imu: bno055: fix OOB access of hw_xlate array
CVE: CVE-2025-39719
Component: kernel
Severity: None
Release date: 2025-09-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iio: imu: bno055: fix OOB access of hw_xlate array

Fix a potential out-of-bounds array access of the hw_xlate array in
bno055.c.

In bno055_get_regmask(), hw_xlate was iterated over the length of the
vals array instead of the length of the hw_xlate array. In the case of
bno055_gyr_scale, the vals array is larger than the hw_xlate array,
so this could result in an out-of-bounds access. In practice, this
shouldn't happen though because a match should always be found which
breaks out of the for loop before it iterates beyond the end of the
hw_xlate array.

By adding a new hw_xlate_len field to the bno055_sysfs_attr, we can be
sure we are iterating over the correct length.


Remediation:
CVE: CVE-2025-6216
Component: Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability
Release date: 2025-06-19T15:12:17.504000+00:00

Allegra calculateTokenExpDate Password Recovery Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the password recovery mechanism. The issue results from reliance upon a predictable value when generating a password reset token. An attacker can leverage this vulnerability to bypass authentication on the application. Was ZDI-CAN-27104.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ALSA: dice: fix buffer overflow in detect_stream_formats()
CVE: CVE-2025-68346
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 6.8/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ALSA: dice: fix buffer overflow in detect_stream_formats()

The function detect_stream_formats() reads the stream_count value directly
from a FireWire device without validating it. This can lead to
out-of-bounds writes when a malicious device provides a stream_count value
greater than MAX_STREAMS.

Fix by applying the same validation to both TX and RX stream counts in
detect_stream_formats().

Statement: This patch fixes a kernel buffer overflow in ALSA FireWire DICE stream format detection by clamping device-provided TX/RX stream_count to MAX_STREAMS. A malicious or buggy FireWire device could otherwise trigger out-of-bounds writes via read_stream_entries(), leading to crashes and potentially memory corruption. The attack surface is physical (device-to-host).

Remediation: