huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
bsdtar hangs and OOMs with zero-length pattern matches
CVE: CVE-2025-60753
Component: libarchive
CWE: CWE-835
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-11-05T00:00:00+00:00

A vulnerability in apply_substitution() function in libarchive's bsdtar allows crafted -s substitution rules to repeatedly match a zero-length substring and append replacements without advancing the input pointer. When the rule uses the global /g flag (or an explicitly empty pattern), this leads to unbounded output allocation and eventual process OOM (Denial of Service). Upgrade to libarchive 3.8.1 or apply a patch that prevents zero-length match loops or rejects empty patterns.

Statement: This vulnerability is rated Moderate rather than Important because its impact is limited to availability and requires user interaction under specific, non-default conditions. Exploitation is only possible when an attacker can directly supply or influence the -s substitution rule passed to bsdtar, which is uncommon in most deployment scenarios since bsdtar is typically invoked with trusted command-line arguments in controlled environments. The flaw does not enable memory corruption, arbitrary code execution, or privilege escalation—it solely results in an infinite loop and memory exhaustion (OOM) leading to a process crash.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
bpf: Check skb->transport_header is set in bpf_skb_check_mtu
CVE: CVE-2025-68363
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check skb->transport_header is set in bpf_skb_check_mtu

The bpf_skb_check_mtu helper needs to use skb->transport_header when
the BPF_MTU_CHK_SEGS flag is used:

	bpf_skb_check_mtu(skb, ifindex, &mtu_len, 0, BPF_MTU_CHK_SEGS)

The transport_header is not always set. There is a WARN_ON_ONCE
report when CONFIG_DEBUG_NET is enabled + skb->gso_size is set +
bpf_prog_test_run is used:

WARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071
 skb_gso_validate_network_len
 bpf_skb_check_mtu
 bpf_prog_3920e25740a41171_tc_chk_segs_flag # A test in the next patch
 bpf_test_run
 bpf_prog_test_run_skb

For a normal ingress skb (not test_run), skb_reset_transport_header
is performed but there is plan to avoid setting it as described in
commit 2170a1f09148 ("net: no longer reset transport_header in __netif_receive_skb_core()").

This patch fixes the bpf helper by checking
skb_transport_header_was_set(). The check is done just before
skb->transport_header is used, to avoid breaking the existing bpf prog.
The WARN_ON_ONCE is limited to bpf_prog_test_run, so targeting bpf-next.


Remediation:
cpuset: fix warning when disabling remote partition
CVE: CVE-2025-71142
Component: kernel
CWE: CWE-480
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A kernel warning was found in the Linux kernel's cpuset cgroup implementation. When a CPU is offlined and this causes subpartitions_cpus to be cleared (no CPUs available for top_cpuset), subsequently disabling a remote partition triggers a spurious warning in remote_partition_disable(). The warning incorrectly fires because effective_xcpus is not a subset of the now-empty subpartitions_cpus.

Statement: This issue affects systems using cpuset cgroup partitions combined with CPU hotplug operations. The specific sequence requires creating exclusive CPU partitions, offlining a CPU that affects partition validity, and then changing the partition type. The result is a kernel warning in the log, but no crash or data corruption occurs. Root privileges are required to modify cgroup configurations.

Remediation:
thunderbird: JIT optimization bug with different stack slot sizes
CVE: CVE-2025-3031
Component: firefox
CWE: CWE-203
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-04-01T12:29:02.220000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: An attacker could read 32 bits of values spilled onto the stack in a JIT compiled function.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
net/sched: fix use-after-free in taprio_dev_notifier
CVE: CVE-2025-38087
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-06-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fix use-after-free in taprio_dev_notifier

Since taprio’s taprio_dev_notifier() isn’t protected by an
RCU read-side critical section, a race with advance_sched()
can lead to a use-after-free.

Adding rcu_read_lock() inside taprio_dev_notifier() prevents this.

Statement: A race condition in taprio_dev_notifier() could lead to a use-after-free (UAF) when it accesses q->oper_sched or q->admin_sched outside of an RCU read-side critical section. This could be exploited by triggering concurrent updates to the taprio scheduler (e.g., via traffic control tools). The issue is resolved by wrapping the relevant accesses in rcu_read_lock()/rcu_read_unlock() and switching from rtnl_dereference() to rcu_dereference(). While the exploitability is low (requires root or CAP_NET_ADMIN), this is a clear use-after-free that can potentially compromise kernel memory. Therefore, CIA: HHH. The Privileges for the CVSS could be Low or High depending on what are the default permissions in the system (basically speaking if user has access to the qdisc, then can trigger it, but by default user would not have such access in Red Hat Enterprise Linux that limits this vulnarability impact level to Moderate).
The CVSS base score is approximately:
6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) in systems where access to traffic control is restricted (like Red Hat Enterprise Linux).
7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) if unprivileged users are allowed to manipulate qdiscs.
The related Kernel config param CONFIG_NET_SCH_TAPRIO enabled only for the latest versions of the Red Hat Enterprise Linux 9 and disabled for the Red Hat Enterprise Linux 8 and before.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent module sch_taprio from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
os: Information disclosure via path traversal using specially crafted filenames
CVE: CVE-2025-22873
Component: os
CWE: CWE-22
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-01-01T00:00:00+00:00

A path traversal vulnerability has been identified in the Go os package affecting the Root abstraction, where improper handling of trailing path separators could allow access to the parent directory of a configured root directory. By supplying a filename ending in "../", an attacker may be able to open the immediate parent directory of the intended Root. Although this escape does not allow traversal to higher-level ancestors or direct access to files within the parent directory, it may expose directory metadata or unintended filesystem structure if the application passes untrusted path input to Root.Open.

Statement: Red Hat Product Security classified this issue as Moderate.

The flaw exists in a local filesystem abstraction within the Go standard library, it can also be exploited remotely in applications that accept attacker-controlled path input over a network and pass it to Root.Open without proper validation. The attack complexity is low, as exploitation requires only appending "../" to the supplied path. However, the impact is limited: the flaw permits opening only the immediate parent directory, not arbitrary filesystem locations or files contained within that directory. There is no direct impact on file integrity or application availability. These constraints limit the practical exposure of the issue while still represents a boundary bypass and may expose unintended filesystem metadata. The issue does not permit traversal beyond the parent directory, modification of files, or broader system compromise, thereby constraining its overall impact.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
CVE: CVE-2025-14412
Component: Soda PDF Desktop XLS File Insufficient UI Warning Remote Code Execution Vulnerability
Release date: 2025-12-11T20:47:52.860000+00:00

Soda PDF Desktop XLS File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Soda PDF Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of XLS files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27495.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Tracking Links in Attachments Bypassed Remote Content Blocking
CVE: CVE-2025-3932
Component: thunderbird
CWE: CWE-288
Severity: Low
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-05-14T16:56:43.939000+00:00

The Mozilla Foundation's Security Advisory describes the following issue: It is possible to craft an email that shows a tracking link as an attachment. If the user attempts to open the attachment, Thunderbird automatically accesses the link. The configuration to block remote content does not prevent that. Thunderbird has been fixed to no longer allow access to web pages listed in the X-Mozilla-External-Attachment-URL header of an email.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
drm/amdgpu: fix slab-use-after-free in amdgpu_userq_mgr_fini+0x70c
CVE: CVE-2025-38603
Component: kernel
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-19T00:00:00+00:00

No description is available for this CVE.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
CVE: CVE-2025-39911
Component: kernel
CWE: CWE-772
Severity: Moderate
CVSS v3: 6.5/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path

If request_irq() in i40e_vsi_request_irq_msix() fails in an iteration
later than the first, the error path wants to free the IRQs requested
so far. However, it uses the wrong dev_id argument for free_irq(), so
it does not free the IRQs correctly and instead triggers the warning:

 Trying to free already-free IRQ 173
 WARNING: CPU: 25 PID: 1091 at kernel/irq/manage.c:1829 __free_irq+0x192/0x2c0
 Modules linked in: i40e(+) [...]
 CPU: 25 UID: 0 PID: 1091 Comm: NetworkManager Not tainted 6.17.0-rc1+ #1 PREEMPT(lazy)
 Hardware name: [...]
 RIP: 0010:__free_irq+0x192/0x2c0
 [...]
 Call Trace:
  <TASK>
  free_irq+0x32/0x70
  i40e_vsi_request_irq_msix.cold+0x63/0x8b [i40e]
  i40e_vsi_request_irq+0x79/0x80 [i40e]
  i40e_vsi_open+0x21f/0x2f0 [i40e]
  i40e_open+0x63/0x130 [i40e]
  __dev_open+0xfc/0x210
  __dev_change_flags+0x1fc/0x240
  netif_change_flags+0x27/0x70
  do_setlink.isra.0+0x341/0xc70
  rtnl_newlink+0x468/0x860
  rtnetlink_rcv_msg+0x375/0x450
  netlink_rcv_skb+0x5c/0x110
  netlink_unicast+0x288/0x3c0
  netlink_sendmsg+0x20d/0x430
  ____sys_sendmsg+0x3a2/0x3d0
  ___sys_sendmsg+0x99/0xe0
  __sys_sendmsg+0x8a/0xf0
  do_syscall_64+0x82/0x2c0
  entry_SYSCALL_64_after_hwframe+0x76/0x7e
  [...]
  </TASK>
 ---[ end trace 0000000000000000 ]---

Use the same dev_id for free_irq() as for request_irq().

I tested this with inserting code to fail intentionally.


Remediation:
A flaw was found in the Linux kernel’s i40e network driver (function i40e_vsi_request_irq_msix()). If request_irq() fails on a later iteration than the first, the error-path tries to call free_irq() for previously requested IRQs but passes an incorrect dev_id. As a result, some IRQs are not properly freed and the driver may trigger kernel warnings or resource cleanup inconsistencies.
wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu()
CVE: CVE-2025-40131
Component: kernel
Severity: None
Release date: 2025-11-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu()

In ath12k_dp_mon_rx_deliver_msdu(), peer lookup fails because
rxcb->peer_id is not updated with a valid value. This is expected
in monitor mode, where RX frames bypass the regular RX
descriptor path that typically sets rxcb->peer_id.
As a result, the peer is NULL, and link_id and link_valid fields
in the RX status are not populated. This leads to a WARN_ON in
mac80211 when it receives data frame from an associated station
with invalid link_id.

Fix this potential issue by using ppduinfo->peer_id, which holds
the correct peer id for the received frame. This ensures that the
peer is correctly found and the associated link metadata is updated
accordingly.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1


Remediation:
smb4k local root exploit
CVE: CVE-2025-66003
Component: smb4k
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-01-01T00:00:00+00:00

An External Control of File Name or Path vulnerability in smb4k allowsl ocal users to perform a local root exploit via smb4k mounthelper if they can access and control the contents of a Samba share

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
DML unspecified vulnerability (CPU Apr 2025)
CVE: CVE-2025-21588
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-15T20:30:58.391000+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).  Supported versions that are affected are 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
HID: wacom: fix crash in wacom_aes_battery_handler()
CVE: CVE-2025-38253
Component: kernel
CWE: CWE-364
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

HID: wacom: fix crash in wacom_aes_battery_handler()

Commit fd2a9b29dc9c ("HID: wacom: Remove AES power_supply after extended
inactivity") introduced wacom_aes_battery_handler() which is scheduled
as a delayed work (aes_battery_work).

In wacom_remove(), aes_battery_work is not canceled. Consequently, if
the device is removed while aes_battery_work is still pending, then hard
crashes or "Oops: general protection fault..." are experienced when
wacom_aes_battery_handler() is finally called. E.g., this happens with
built-in USB devices after resume from hibernate when aes_battery_work
was still pending at the time of hibernation.

So, take care to cancel aes_battery_work in wacom_remove().


Remediation:
.NET Remote Code Vulnerability
CVE: CVE-2025-30399
Component: dotnet
CWE: CWE-427
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-06-10T00:00:00+00:00

A remote code execution vulnerability in .NET 8.0 and 9.0. An attacker who can place malicious files in specific locations may trigger unintended code execution when the .NET runtime loads these files.

Statement: This vulnerability is Important because it allows remote code execution at the runtime level, targeting the fundamental assembly loading mechanism of .NET. Unlike moderate flaws that may require complex chaining or rely on user interaction, this issue can be exploited simply by placing malicious files in specific directories that .NET probes during execution.

```

.NET 6.0 for RHEL-8, RHEL-9 and RHIVOS has reached its End of Life as of November 12, 2024, and is no longer supported. No fixes will be provided for this stream. For additional information about lifecycle for .NET on Red Hat Enterprise Linux, please refer to: https://access.redhat.com/support/policy/updates/net-core.

```

Remediation:
Mitigation for this issue is either not available or the currently available options don’t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
GNU elfutils eu-readelf readelf.c print_string_section buffer overflow
CVE: CVE-2025-1372
Component: elfutils
CWE: CWE-120
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-02-17T03:00:36.624000+00:00

A flaw was found in GNU elfutils. This vulnerability allows buffer overflow, potentially leading to arbitrary code execution or crashes via manipulation of the 'z/x' argument in the dump_data_section/print_string_section function of readelf.c.


Remediation:
net_sched: Prevent creation of classes with TC_H_ROOT
CVE: CVE-2025-21971
Component: kernel
CWE: CWE-703
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net_sched: Prevent creation of classes with TC_H_ROOT

The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination
condition when traversing up the qdisc tree to update parent backlog
counters. However, if a class is created with classid TC_H_ROOT, the
traversal terminates prematurely at this class instead of reaching the
actual root qdisc, causing parent statistics to be incorrectly maintained.
In case of DRR, this could lead to a crash as reported by Mingi Cho.

Prevent the creation of any Qdisc class with classid TC_H_ROOT
(0xFFFFFFFF) across all qdisc types, as suggested by Jamal.


Remediation:
CivetWeb buffer overflow
CVE: CVE-2025-55763
Component: civetweb
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-08-29T00:00:00+00:00

A buffer overflow flaw was found in CivetWeb. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to a denial of service or arbitrary code execution.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
--disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom
CVE: CVE-2025-62410
Component: happy-dom
CWE: CWE-1321
Severity: Important
CVSS v3: 7.4/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
Release date: 2025-10-15T17:16:21.561000+00:00

In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like "process" in the example below, or to hijack control flow via flipping checks of undefined property. This vulnerability is due to an incomplete fix for CVE-2025-61927. The vulnerability is fixed in 20.0.2.

Statement: The impact is IMPORTANT because disabling dynamic code generation alone does not create a separate execution context. Trusted and untrusted code still share the same global prototypes and intrinsic objects; a polluted prototype is immediately visible to the rest of the process.
The flaw arises from incomplete sandboxing. The mitigation for dynamic code generation only blocks eval and Function but does not isolate execution contexts. As both trusted and untrusted scripts share prototypes in one isolate, a polluted built-in can redirect internal lookups or override constructors to expose privileged globals. This enables arbitrary command execution from within the supposedly restricted environment.

Remediation: