huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Linux kernel: Denial of Service in ATM CLIP module via infinite recursion
CVE: CVE-2025-38459
Component: kernel
CWE: CWE-835
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-07-25T00:00:00+00:00

A flaw was found in the Linux kernel's Asynchronous Transfer Mode (ATM) Classical IP (CLIP) module. A local user can trigger an infinite recursive call in the `clip_push()` function by repeatedly calling the `ioctl(ATMARP_MKIP)` system call. This vulnerability occurs when the socket is closed, leading to stack exhaustion and a kernel crash, resulting in a Denial of Service (DoS).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-13709
Component: Tencent TFace restore_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability
Release date: 2025-12-01T22:45:18.593000+00:00

Tencent TFace restore_checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent TFace. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the restore_checkpoint function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27185.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
OpenVPN in a server role with tls-crypt-v2 enabled can reach an assertion failed state when receiving specially crafted packets
CVE: CVE-2025-2704
Component: openvpn
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-02T21:00:58.582000+00:00

OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
wifi: mt76: disable napi on driver removal
CVE: CVE-2025-38009
Component: kernel
CWE: CWE-20
Severity: Low
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: disable napi on driver removal

A warning on driver removal started occurring after commit 9dd05df8403b
("net: warn if NAPI instance wasn't shut down"). Disable tx napi before
deleting it in mt76_dma_cleanup().

 WARNING: CPU: 4 PID: 18828 at net/core/dev.c:7288 __netif_napi_del_locked+0xf0/0x100
 CPU: 4 UID: 0 PID: 18828 Comm: modprobe Not tainted 6.15.0-rc4 #4 PREEMPT(lazy)
 Hardware name: ASUS System Product Name/PRIME X670E-PRO WIFI, BIOS 3035 09/05/2024
 RIP: 0010:__netif_napi_del_locked+0xf0/0x100
 Call Trace:
 <TASK>
 mt76_dma_cleanup+0x54/0x2f0 [mt76]
 mt7921_pci_remove+0xd5/0x190 [mt7921e]
 pci_device_remove+0x47/0xc0
 device_release_driver_internal+0x19e/0x200
 driver_detach+0x48/0x90
 bus_remove_driver+0x6d/0xf0
 pci_unregister_driver+0x2e/0xb0
 __do_sys_delete_module.isra.0+0x197/0x2e0
 do_syscall_64+0x7b/0x160
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Tested with mt7921e but the same pattern can be actually applied to other
mt76 drivers calling mt76_dma_cleanup() during removal. Tx napi is enabled
in their *_dma_init() functions and only toggled off and on again inside
their suspend/resume/reset paths. So it should be okay to disable tx
napi in such a generic way.

Found by Linux Verification Center (linuxtesting.org).


Remediation:
Seafile: Stored Cross-Site Scripting (XSS) vulnerability allows arbitrary code execution
CVE: CVE-2025-41080
Component: seafile
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-12-04T11:48:44.776000+00:00

A flaw was found in Seafile. This vulnerability allows an attacker to execute arbitrary code in the victim's browser by storing malicious payloads with POST parámetro 'p' in '/api/v2.1/repos/{repo_id}/file/', leading to a stored Cross-Site Scripting (XSS).

Statement: This vulnerability is rated Moderate for Red Hat products. A stored Cross-Site Scripting (XSS) flaw in Seafile allows an attacker to execute arbitrary code in a victim's browser by injecting malicious payloads into files. This affects Red Hat Community Projects, specifically Seafile on Fedora 42 and Fedora 43.

Remediation:
Restrict network access to the Seafile service to trusted networks and users. Configure firewall rules to limit inbound connections to the ports used by Seafile. For example, using `firewalld`, specific ports can be restricted to source IP addresses or zones. Applying these network restrictions may require reloading the firewall service.
FluidSynth: Race Condition in DLS Unloading Allows Code Execution and Privilege Escalation
CVE: CVE-2025-68617
Component: FluidSynth
CVSS v3: 6.9/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-23T22:41:28.861000+00:00

A flaw was found in FluidSynth, a software synthesizer. This vulnerability involves a race condition that occurs when a DLS (Downloadable Sounds) file is being unloaded. If another process simultaneously tries to unload the same file or use its audio samples, it can lead to a 'use-after-free' error, where the program attempts to access memory that has already been released. This critical issue could allow a local attacker to execute unauthorized code, gain elevated system access, or cause the application to crash, resulting in a denial of service.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2025-15327
Component: Tanium addressed an improper access controls vulnerability in Deploy.
Release date: 2025-01-22T00:00:00+00:00

Tanium addressed an improper access controls vulnerability in Deploy.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
arcnet: Add NULL check in com20020pci_probe()
CVE: CVE-2025-22054
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

arcnet: Add NULL check in com20020pci_probe()

devm_kasprintf() returns NULL when memory allocation fails. Currently,
com20020pci_probe() does not check for this case, which results in a
NULL pointer dereference.

Add NULL check after devm_kasprintf() to prevent this issue and ensure
no resources are left allocated.


Remediation:
Eclipse Che — unauthenticated RCE and secret exfiltration via TCP/3333
CVE: CVE-2025-12548
Component: github.com/che-incubator/che-code
CWE: CWE-306
Severity: Important
CVSS v3: 8.8/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Release date: 2025-12-02T07:07:00+00:00

A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration (SSH keys, tokens, etc.) from other users' Developer Workspace containers, via an unauthenticated JSON-RPC / websocket API exposed on TCP port 3333.


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
Apply the security best practices from the Red Hat OpenShift Dev Spaces Administration Guide:
https://docs.redhat.com/en/documentation/red_hat_openshift_dev_spaces/3.24/html/administration_guide/security-best-practices
posix-timers: Plug potential memory leak in do_timer_create()
CVE: CVE-2025-68247
Component: kernel
Severity: None
Release date: 2025-12-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

posix-timers: Plug potential memory leak in do_timer_create()

When posix timer creation is set to allocate a given timer ID and the
access to the user space value faults, the function terminates without
freeing the already allocated posix timer structure.

Move the allocation after the user space access to cure that.

[ tglx: Massaged change log ]


Remediation:
wifi: mt76: mt7915: fix list corruption after hardware restart
CVE: CVE-2025-39862
Component: kernel
CWE: CWE-665
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-09-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7915: fix list corruption after hardware restart

Since stations are recreated from scratch, all lists that wcids are added
to must be cleared before calling ieee80211_restart_hw.
Set wcid->sta = 0 for each wcid entry in order to ensure that they are
not added again before they are ready.

Statement: On mt76/mt7915, a full hardware restart recreated stations but failed to clear WCID and driver lists, leading to list corruption and potential crashes after ieee80211_restart_hw(). The fix adds mt76_reset_device() to reset all WCID entries (set wcid->sta = 0, detach and clean), clear list heads and masks, and re-init per-PHY TX lists before restarting. This is primarily a local DoS in specific mt7915 setups (typically requiring CAP_NET_ADMIN or a firmware reset path).

Remediation:
Heap Buffer Over-Read in PSPP rijndaelDecrypt Function
CVE: CVE-2025-48188
Component: pspp
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Release date: 2025-05-16T00:00:00+00:00

A flaw was found in GNU PSPP's libpspp-core.a component. This vulnerability can allow a heap-based buffer over-read via a crafted encrypted file when the rijndaelDecrypt function is incorrectly called by fill_buffer in encrypted-file.c. This can lead to memory disclosure or an application crash.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
From CVEorg collector
CVE: CVE-2025-59799
Component: Artifex Ghostscript
CWE: CWE-121
Severity: Moderate
CVSS v3: 3.9/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-09-22T00:00:00+00:00

Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value.


Remediation:
net: hns3: fix oops when unload drivers paralleling
CVE: CVE-2025-21802
Component: kernel
CWE: CWE-413
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: hns3: fix oops when unload drivers paralleling

When unload hclge driver, it tries to disable sriov first for each
ae_dev node from hnae3_ae_dev_list. If user unloads hns3 driver at
the time, because it removes all the ae_dev nodes, and it may cause
oops.

But we can't simply use hnae3_common_lock for this. Because in the
process flow of pci_disable_sriov(), it will trigger the remove flow
of VF, which will also take hnae3_common_lock.

To fixes it, introduce a new mutex to protect the unload process.


Remediation:
golang: Panic when validating certificates with DSA public keys in crypto/x509
CVE: CVE-2025-58188
Component: crypto/x509
CWE: CWE-617
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-10-29T22:10:14.143000+00:00

A denial of service vector has been discovered in the golang crypto/x509 module. An attacker could craft an intermediate X.509 certificate containing a DSA public key and can crash a remote host with an unauthenticated call to any endpoint that verifies the certificate chain.

Statement: Availability impacts are limited on Red Hat products as they do not affect the host systems.

Remediation:
vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs`
CVE: CVE-2025-62426
Component: vllm
CWE: CWE-770
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-11-21T01:21:29.546000+00:00

A vulnerability in vLLM allows an authenticated user to trigger unintended tokenization during chat template processing by supplying crafted chat_template_kwargs to the /v1/chat/completions or /tokenize endpoints. By forcing the server to tokenize very large inputs, an attacker can block the API server’s event loop for extended periods, causing a denial of service and delaying all other requests.

Statement: The flaw is limited to a denial-of-service vector that requires an authenticated user and relies on abusing an optional, non-security-critical parameter (chat_template_kwargs) to force unexpected tokenization during template application, which is computationally expensive but not indicative of data corruption, privilege escalation, or code execution. The attacker cannot break isolation boundaries or execute arbitrary logic—they can only cause the server’s event loop to stall through large crafted inputs, and only if they already have access to the vLLM API. Moreover, the DoS condition is resource-intensive, depends heavily on model size and server configuration, and does not persist once the malicious request completes. Because the impact is bounded to temporary availability degradation without confidentiality or integrity loss, and because exploitation requires legitimate API access and large payloads, this issue aligns with a Moderate severity rather than an Important/High flaw.

Remediation:
For more information visit https://access.redhat.com/errata/RHSA-2026:3461
For more information visit https://access.redhat.com/errata/RHSA-2026:3462
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
ksmbd: fix type confusion via race condition when using ipc_msg_send_request
CVE: CVE-2025-21947
Component: kernel
CWE: CWE-362
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix type confusion via race condition when using ipc_msg_send_request

req->handle is allocated using ksmbd_acquire_id(&ipc_ida), based on
ida_alloc. req->handle from ksmbd_ipc_login_request and
FSCTL_PIPE_TRANSCEIVE ioctl can be same and it could lead to type confusion
between messages, resulting in access to unexpected parts of memory after
an incorrect delivery. ksmbd check type of ipc response but missing add
continue to check next ipc reponse.


Remediation:
Excessive read buffering DoS in http.client
CVE: CVE-2025-13836
Component: cpython
CWE: CWE-770
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
Release date: 2025-12-01T18:02:38.483000+00:00

A flaw was found in the http.client module in the Python standard library. When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This issue allows a malicious server to cause the client to read large amounts of data into memory, potentially causing memory allocations errors, swapping, out-of-memory conditions or even system freezes.

Statement: This issue can only be exploited by Python applications using the http.client.HTTPResponse.read function without the amount parameter, which specifies the read size in bytes. Note that Python libraries may use this function internally and make applications vulnerable. Additionally, vulnerable Python applications must connect to a malicious or compromised server that replies with a very large or crafted Content-Length header to trigger this issue, limiting the exposure of this vulnerability.

Remediation:
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
Since this vulnerability is triggered when no read amount is specified and the client defaults to using the potentially malicious Content-Length header, developers can mitigate this issue in their code by always imposing an explicit, safe limit on data reads.

Applications using the http.client.HTTPResponse.read function directly can ensure that read operations specify a byte limit:

~~~
...
max_safe_read = 10 * 1024 * 1024
data = response.read(max_safe_read)
...
~~~
YugabyteDB authentication bypass
CVE: CVE-2025-8866
Component: yugabytedb
CWE: CWE-200
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-08-11T16:25:35.897000+00:00

An authentication flaw has been discovered in YugabyteDB. Access is not properly enforced for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain server networking configuration details, including private and public IP addresses and DNS records.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
LoongArch: BPF: Fix off-by-one error in build_prologue()
CVE: CVE-2025-37893
Component: kernel
CWE: CWE-193
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: BPF: Fix off-by-one error in build_prologue()

Vincent reported that running BPF progs with tailcalls on LoongArch
causes kernel hard lockup. Debugging the issues shows that the JITed
image missing a jirl instruction at the end of the epilogue.

There are two passes in JIT compiling, the first pass set the flags and
the second pass generates JIT code based on those flags. With BPF progs
mixing bpf2bpf and tailcalls, build_prologue() generates N insns in the
first pass and then generates N+1 insns in the second pass. This makes
epilogue_offset off by one and we will jump to some unexpected insn and
cause lockup. Fix this by inserting a nop insn.


Remediation:
libbpf: Fix accessing BTF.ext core_relo header
CVE: CVE-2025-37939
Component: kernel
Severity: None
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

libbpf: Fix accessing BTF.ext core_relo header

Update btf_ext_parse_info() to ensure the core_relo header is present
before reading its fields. This avoids a potential buffer read overflow
reported by the OSS Fuzz project.


Remediation:
ASAR Integrity Bypass via resource modification
CVE: CVE-2025-55305
Component: electron
CWE: CWE-494
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L
Release date: 2025-09-04T23:05:07.274000+00:00

A vulnerability has been identified in Electron where ASAR integrity validation can be bypassed through modification of application resources. An attacker with local write access to the application’s installation directory can tamper with files inside the resources folder, undermining the intended protections and allowing unauthorized changes to the application.

Statement: This vulnerability is rated Moderate as it requires specific conditions for exploitation: the application must have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` fuses enabled, and the attacker must already have local write access to the application’s installation directory.

Remediation:
No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.