huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
ipvlan: Make the addrs_lock be per port
CVE: CVE-2026-23103
Component: kernel
CWE: CWE-413
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A race condition vulnerability was found in the Linux kernel's ipvlan driver. The per-device addrs_lock was incorrectly used instead of a per-port lock, and some code paths (ipvlan_open/ipvlan_close) failed to acquire the lock entirely. For IPv6 address changes that don't require RTNL lock, concurrent address additions could cause false-negative results from ipvlan_addr_busy() or race conditions when adding addresses to the hash table.

Statement: This race condition has limited practical exploitability as it requires precise timing of concurrent IPv6 address changes on ipvlan interfaces. The upstream commit describes it as "a very minor problem" since simultaneous ipvlan_add_addr() calls on multiple CPUs are highly unlikely. The potential consequences are address conflict detection failures or hash table corruption, not direct memory corruption or code execution.

Remediation:
To mitigate this issue, prevent the ipvlan module from being loaded if IP-based virtual LAN networking is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.
foreman_kubevirt: Man-in-the-Middle due to insecure default SSL verification
CVE: CVE-2026-1531
Component: foreman-kubevirt
CWE: CWE-295
Severity: Important
CVSS v3: 8.3/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-01-28T12:34:00+00:00

A flaw was found in foreman_kubevirt. When configuring the connection to OpenShift, the system disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set. This insecure default allows a remote attacker, capable of intercepting network traffic between Satellite and OpenShift, to perform a Man-in-the-Middle (MITM) attack. Such an attack could lead to the disclosure or alteration of sensitive information.

Statement: This is an IMPORTANT flaw in foreman_kubevirt where the default configuration for connecting to OpenShift disables SSL verification if a CA certificate is not explicitly provided. This insecure default allows a remote attacker to perform a Man-in-the-Middle attack by intercepting network traffic between Satellite and OpenShift, potentially leading to information disclosure or alteration.

Remediation:
To mitigate this issue, ensure that a Certificate Authority (CA) certificate is explicitly configured when setting up the connection to OpenShift in foreman_kubevirt. This will enable SSL verification and prevent Man-in-the-Middle attacks. Refer to the foreman_kubevirt documentation for specific instructions on configuring CA certificates. A restart or service reload may be required for the changes to take effect.
x86: incomplete IBPB for vCPU isolation
CVE: CVE-2026-23553
Component: xen
CVSS v3: 2.8/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-01-28T15:33:44.782000+00:00

In the context switch logic Xen attempts to skip an IBPB in the case of
a vCPU returning to a CPU on which it was the previous vCPU to run.
While safe for Xen's isolation between vCPUs, this prevents the guest
kernel correctly isolating between tasks.  Consider:

 1) vCPU runs on CPU A, running task 1.
 2) vCPU moves to CPU B, idle gets scheduled on A.  Xen skips IBPB.
 3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB.
 4) vCPU moves back to CPU A.  Xen skips IBPB again.

Now, task 2 is running on CPU A with task 1's training still in the BTB.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Chromium: Remote heap corruption via crafted HTML page
CVE: CVE-2026-1862
Component: Chromium
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-03T20:56:48.455000+00:00

Type Confusion in V8 in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2026-0770
Component: Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
Release date: 2026-01-09T16:38:08.818000+00:00

Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
FreeRDP heap-use-after-free
CVE: CVE-2026-22856
Component: freerdp
CWE: CWE-416
Severity: Moderate
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-01-14T17:53:04.756000+00:00

A heap use after free flaw has been discovered in FreeRDP. A race in the serial channel IRP thread tracking allows a heap use‑after‑free when one thread removes an entry from serial->IrpThreads while another reads it.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Radare2: Local resource consumption via Mach-O File Parser
CVE: CVE-2026-4174
Component: Radare2
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-15T10:32:10.553000+00:00

A flaw was found in Radare2. A local attacker could exploit a vulnerability in the Mach-O File Parser component, specifically within the `walk_exports_trie` function. By manipulating this component, an attacker can cause excessive resource consumption, potentially leading to a Denial of Service (DoS). An exploit for this issue has been publicly disclosed.

Statement: This MODERATE impact vulnerability in Radare2 allows a local attacker to cause resource consumption by manipulating Mach-O files. The flaw affects the `walk_exports_trie` function within the Mach-O File Parser component. Exploitation requires local access to the system.

Remediation:
Inappropriate implementation in V8
CVE: CVE-2026-4461
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

An inappropriate implementation flaw was found in the V8 component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=490558172

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
xfs: only call xf{array,blob}_destroy if we have a valid pointer
CVE: CVE-2026-23251
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the Linux kernel's XFS filesystem. The xfarray_destroy() and xfblob_destroy() functions are called without checking if the pointer is valid. When these destructors are invoked on NULL pointers during cleanup paths, a kernel crash occurs. The fix adds NULL checks before calling the destructors and nullifies the pointers afterward to prevent double-free issues.

Statement: This flaw affects XFS filesystems in kernels between 6.9 and 6.10 where the xfarray and xfblob infrastructure was introduced for online repair functionality. The NULL pointer dereference occurs in error handling and cleanup paths. While this can cause a kernel crash, exploitation requires triggering specific error conditions in XFS scrub/repair operations.

Remediation:
HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()
CVE: CVE-2026-23178
Component: kernel
CWE: CWE-120
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-14T00:00:00+00:00

A potential buffer overflow vulnerability was found in the i2c-hid driver. When handling HID reports via the hidraw interface, userspace can request a recv_len up to HID_MAX_BUFFER_SIZE (16384 bytes), but the destination buffer ihid->rawbuf may be smaller, leading to a heap buffer overflow.

Statement: As noted in the patch, access to hidraw devices requires root privileges (or specific device permissions). The practical impact is limited since an attacker would already need elevated access to exploit this vulnerability. The overflow could potentially be used for local privilege escalation but the attack surface is constrained.

Remediation:
MuPDF: Denial of Service via crafted input during barcode decoding
CVE: CVE-2026-25556
Component: MuPDF
CVSS v3: 5.2/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-02-06T16:11:59.926000+00:00

A flaw was found in MuPDF. An attacker can exploit a double-free vulnerability in the `fz_fill_pixmap_from_display_list()` function by processing crafted input that causes a rendering-time error during barcode decoding. This can lead to heap corruption and a process crash, resulting in a Denial of Service (DoS).

Statement: This MODERATE impact vulnerability in MuPDF affects applications that utilize its barcode decoding functionality. The flaw can be triggered when processing specially crafted input that causes a rendering error during barcode decoding, leading to a double-free and potential application crash. Red Hat products are affected if they enable and use MuPDF for barcode decoding.

Remediation:
OCaml: Remote code execution via buffer over-read in Marshal deserialization
CVE: CVE-2026-28364
Component: ocaml
CWE: CWE-125
Severity: Important
CVSS v3: 7.8/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Release date: 2026-02-27T03:54:53.458000+00:00

A flaw was found in OCaml. A remote attacker could exploit a buffer over-read vulnerability during Marshal deserialization by providing specially crafted data. This issue stems from missing bounds validation in the readblock() function, which performs unbounded memory copy operations. Successful exploitation could lead to remote code execution.


Remediation:
Keycloak: Information disclosure via authorization bypass in Admin API
CVE: CVE-2026-2366
Component: keycloak
CWE: CWE-639
Severity: Low
CVSS v3: 3.2/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-02-11T11:11:00+00:00

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.

Statement: This LOW impact authorization bypass in the Keycloak Admin API allows an authenticated user to enumerate organization memberships of other users if their UUID is known. This occurs when the Organizations feature is enabled.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
OpenSSL TLS 1.3 server may choose unexpected key agreement group
CVE: CVE-2026-2673
Component: openssl
CWE: CWE-325
Severity: Low
CVSS v3: 3.2/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Release date: 2026-03-13T13:23:00.376000+00:00

A key group selection preference flaw has been discovered in OpenSSL. An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the "DEFAULT" keyword. A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Out of bounds read and write in Tint
CVE: CVE-2026-3062
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-23T00:00:00+00:00

Out of bounds read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
PDF injection in AcroForm module allows arbitrary JavaScript execution (RadioButton children)
CVE: CVE-2026-25940
Component: jsPDF
CWE: CWE-116
Severity: Important
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-02-19T15:26:57.645000+00:00

A flaw was found in jsPDF. The properties and methods of the Acroform module accept user input without sanitization, allowing an attacker to inject arbitrary PDF objects, such as JavaScript actions. Specifically, if an attacker can supply a specially crafted input to the AcroformChildClass.appearanceState property, JavaScript actions can be executed when a user opens the generated PDF document and hovers over the radio button.

Statement: To exploit this flaw, an attacker must be able to supply a specially crafted input to the AcroformChildClass.appearanceState property of the Acroform module and convince a user to open the generated PDF document, resulting in arbitrary JavaScript execution when the user interacts with radio buttons. Due to these reasons, this vulnerability has been rated with an important severity.

Remediation:
To mitigate this vulnerability, sanitize the user-provided input before passing it to the AcroformChildClass.appearanceState property or other API members. Additionally, do not open PDF documents from untrusted sources.
Linux kernel i2c-imx driver: Denial of Service via invalid I2C block data length handling
CVE: CVE-2026-23197
Component: kernel
CWE: CWE-835
Severity: Moderate
CVSS v3: 6.3/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's i2c-imx driver. A local attacker could exploit a vulnerability in the block data length handler. When an I2C block read returns an invalid length, the system enters an endless read loop, leading to buffer overruns and a system crash, resulting in a Denial of Service (DoS).

Statement: This is a MODERATE impact denial of service flaw in the Linux kernel's i2c-imx driver. A local attacker could trigger an endless read loop by providing an invalid I2C block data length, leading to a system crash. Red Hat Enterprise Linux 6, 7, 8, and 9 are not affected as the vulnerable code is not present. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS are affected.

Remediation:
To mitigate this issue, if the `i2c-imx` kernel module is not essential for system operation, it can be prevented from loading. Create a file named `/etc/modprobe.d/blacklist-i2c-imx.conf` with the content `blacklist i2c-imx`. After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This can be done using the commands: `dracut -f -v` followed by `reboot`. Be aware that blacklisting this module may impact functionality if I2C devices relying on the `i2c-imx` driver are in use.
Python-Multipart: Arbitrary file write via path traversal vulnerability
CVE: CVE-2026-24486
Component: python-multipart
CWE: CWE-22
Severity: Important
CVSS v3: 8.6/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Release date: 2026-01-27T00:34:06.229000+00:00

A flaw was found in Python-Multipart, a tool for parsing multipart form data in Python applications. This vulnerability, known as path traversal, allows a remote attacker to write uploaded files to any location on the server's file system. This exploitation occurs when specific non-default configuration options, `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`, are enabled, and a malicious filename is provided during a file upload. The primary consequence is unauthorized file creation or modification, which could lead to system compromise.


Remediation:
For more information visit https://access.redhat.com/errata/RHSA-2026:3461
For more information visit https://access.redhat.com/errata/RHSA-2026:3462
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade
For Red Hat OpenShift AI 2.25.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
For Red Hat OpenShift AI 3.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
For Satellite MCP integration see the Red Hat Satellite documentation.
To mitigate this vulnerability, avoid enabling the `UPLOAD_KEEP_FILENAME=True` configuration option in applications using `python-multipart`. This option, when used with `UPLOAD_DIR`, allows an attacker to write files to arbitrary locations. Disabling or not configuring `UPLOAD_KEEP_FILENAME=True` prevents the path traversal vulnerability.
OliveTin Unauthorized Action Output Disclosure via EventStream
CVE: CVE-2026-32102
Component: olivetin
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-11T20:05:16.164000+00:00

OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are not allowed to view, resulting in broken access control and sensitive information disclosure.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
libpng: Information disclosure and denial of service via integer truncation in simplified write API
CVE: CVE-2026-22801
Component: libpng
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.5/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Release date: 2026-01-12T22:57:58.288000+00:00

A flaw was found in libpng, a reference library for PNG (Portable Network Graphics) raster image files. An integer truncation vulnerability exists in the png_write_image_16bit and png_write_image_8bit simplified write API functions. A local attacker could exploit this flaw by providing a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes, leading to a heap buffer over-read. This can result in information disclosure or a denial of service (DoS) to the system.

Statement: This vulnerability is rated Moderate for Red Hat products. An integer truncation flaw in the libpng simplified write API functions (`png_write_image_16bit`, `png_write_image_8bit`) can lead to a heap buffer over-read. Exploitation requires an application to process specially crafted input that provides a negative row stride or a stride exceeding 65535 bytes, potentially resulting in denial of service or information disclosure.

Remediation:
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
allocation of resources without limits or throttling via specially crafted request
CVE: CVE-2026-0530
Component: kibana
CWE: CWE-770
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-13T21:03:13.655000+00:00

A flaw was found in Kibana Fleet. A remote attacker could exploit this vulnerability by sending a specially crafted request, leading to an excessive allocation of resources. This continuous consumption of system resources can result in service degradation or complete unavailability, effectively causing a Denial of Service (DoS).

Statement: This issue allows a remote attacker with low-level privileges to cause an excessive allocation of resources by sending specially crafted requests, eventually resulting in a denial of service. As the attacker must have low-level privileges to exploit this issue, this vulnerability has been rated with a moderate severity.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.