huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
dr_flac: Denial of Service via integer overflow in FLAC metadata
CVE: CVE-2025-14369
Component: dr_flac
CVSS v3: 5.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in dr_flac, an audio decoder within the dr_libs toolset. This integer overflow vulnerability occurs due to the tool trusting the `totalPCMFrameCount` field from FLAC (Free Lossless Audio Codec) metadata without proper buffer size calculation. An attacker can exploit this by providing a specially crafted FLAC file, which leads to a Denial of Service (DoS) against programs that use the tool.

Statement: This vulnerability is rated Moderate for Red Hat products. The `dr_flac` audio decoder, used by components like `SDL2_sound` and `SDL3_sound` in Fedora, is susceptible to an integer overflow when processing specially crafted FLAC metadata. This flaw could lead to a denial of service in applications that utilize the affected `dr_flac` component to decode untrusted FLAC files.

Remediation:
Kernel: Double free vulnerability in exFAT filesystem can lead to denial of service
CVE: CVE-2025-38206
Component: kernel
CWE: CWE-763
Severity: Moderate
CVSS v3: 7.5/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Release date: 2025-07-04T00:00:00+00:00

A flaw was found in the Linux kernel's exFAT filesystem driver. A local attacker with low privileges could exploit a double free vulnerability within the `delayed_free` function. This memory corruption flaw can lead to a denial of service (DoS), potentially causing system instability or crashes. It may also result in information disclosure.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Redis is vulnerable to DoS via specially crafted LUA scripts
CVE: CVE-2025-46819
Component: Redis
CWE: CWE-190
Severity: Moderate
CVSS v3: 6.3/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2025-10-03T19:12:10.999000+00:00

A vulnerability was found in Redis where an authenticated user to run a crafted Lua script that can read out‑of‑bounds memory or crash the server, leading to information disclosure and denial of service.

Statement: This is rated Moderate because exploitation requires an authenticated Redis account with permission to execute Lua (EVAL/FUNCTION), and the impact is limited to out‑of‑bounds reads and process crash (DoS) rather than code execution or privilege escalation. The attack surface is limited to environments where the attacker already possesses valid credentials and can invoke Lua (EVAL/FUNCTION), raising exploitation complexity and narrowing exposure compared to unauthenticated or privilege‑escalating flaws.

This flaw exists only in the Redis server implementation; 

Redis client libraries (Python, Node.js, Rust, etc.) are not affected by this vulnerability, and it only exists in the Redis server’s embedded Lua engine where scripts execute. Client libraries merely transmit EVAL/EVALSHA to the server.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.

To reduce the risk, restricting network access to trusted hosts, enforcing strong authentication and protected-mode, disabling or limiting Lua scripting where possible can be be benificial and apply least-privilege ACLs to reduce who can run scripting commands, keep instances non-public with firewalls/VPCs, and follow Redis hardening guidance to minimize exposure.
MediaWiki: Sensitive information exposure to unauthorized actors
CVE: CVE-2025-61639
Component: MediaWiki
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in MediaWiki. This vulnerability, categorized as an Exposure of Sensitive Information to an Unauthorized Actor, allows an unauthorized individual to access sensitive data. The issue stems from how MediaWiki handles logging and recent changes, potentially leading to the disclosure of confidential information.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
usbnet: Fix using smp_processor_id() in preemptible code warnings
CVE: CVE-2025-40164
Component: kernel
CWE: CWE-662
Severity: Low
CVSS v3: 2.9/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-11-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usbnet: Fix using smp_processor_id() in preemptible code warnings

Syzbot reported the following warning:

BUG: using smp_processor_id() in preemptible [00000000] code: dhcpcd/2879
caller is usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331
CPU: 1 UID: 0 PID: 2879 Comm: dhcpcd Not tainted 6.15.0-rc4-syzkaller-00098-g615dca38c2ea #0 PREEMPT(voluntary)
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
 check_preemption_disabled+0xd0/0xe0 lib/smp_processor_id.c:49
 usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331
 usbnet_resume_rx+0x4b/0x170 drivers/net/usb/usbnet.c:708
 usbnet_change_mtu+0x1be/0x220 drivers/net/usb/usbnet.c:417
 __dev_set_mtu net/core/dev.c:9443 [inline]
 netif_set_mtu_ext+0x369/0x5c0 net/core/dev.c:9496
 netif_set_mtu+0xb0/0x160 net/core/dev.c:9520
 dev_set_mtu+0xae/0x170 net/core/dev_api.c:247
 dev_ifsioc+0xa31/0x18d0 net/core/dev_ioctl.c:572
 dev_ioctl+0x223/0x10e0 net/core/dev_ioctl.c:821
 sock_do_ioctl+0x19d/0x280 net/socket.c:1204
 sock_ioctl+0x42f/0x6a0 net/socket.c:1311
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:906 [inline]
 __se_sys_ioctl fs/ioctl.c:892 [inline]
 __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

For historical and portability reasons, the netif_rx() is usually
run in the softirq or interrupt context, this commit therefore add
local_bh_disable/enable() protection in the usbnet_resume_rx().


Remediation:
CIRCL-Fourq: Missing and wrong validation can lead to incorrect results
CVE: CVE-2025-8556
Component: github.com/cloudflare/circl
CWE: CWE-1287
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-06-10T21:18:33+00:00

A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()
CVE: CVE-2025-38656
Component: kernel
CWE: CWE-416
Severity: None
Release date: 2025-08-22T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()

Preserve the error code if iwl_setup_deferred_work() fails.  The current
code returns ERR_PTR(0) (which is NULL) on this path.  I believe the
missing error code potentially leads to a use after free involving
debugfs.


Remediation:
Step CA: Denial of Service via improper SSH certificate revocation authorization
CVE: CVE-2025-66406
Component: github.com/smallstep/certificates
CVSS v3: 5.5/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
Release date: 2025-12-03T19:13:48.240000+00:00

A flaw was found in Step CA, an online certificate authority. This vulnerability allows a highly privileged attacker to improperly revoke SSH certificates. Such unauthorized revocation can disrupt services, leading to a denial of service for systems configured with the SSHPOP provisioner that rely on these certificates for secure access.

Statement: This vulnerability is rated Moderate because it allows a highly privileged attacker to improperly revoke SSH certificates in Step CA deployments configured with the SSHPOP provisioner, leading to a denial of service. This impacts Red Hat products utilizing Step CA with the SSHPOP provisioner.

Remediation:
net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error
CVE: CVE-2025-21924
Component: kernel
CWE: CWE-459
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error

During the initialization of ptp, hclge_ptp_get_cycle might return an error
and returned directly without unregister clock and free it. To avoid that,
call hclge_ptp_destroy_clock to unregist and free clock if
hclge_ptp_get_cycle failed.


Remediation:
Maypole for Perl generates session ids insecurely
CVE: CVE-2025-15578
Component: maypole
CVSS v3: 4.7/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2025-01-01T00:00:00+00:00

Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the system time (which is available from HTTP response headers), a call to the built-in rand() function, and the PID.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
btrfs: do not free data reservation in fallback from inline due to -ENOSPC
CVE: CVE-2025-71269
Component: kernel
CWE: CWE-832
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A resource accounting flaw was found in the Linux kernel's btrfs filesystem. When creating an inline extent fails with -ENOSPC, the code falls back to the normal COW (copy-on-write) path. However, it incorrectly frees the reserved qgroup data even though the data will still be written via the fallback path. This causes qgroup accounting to become inconsistent, potentially allowing data writes to exceed quota limits.

Statement: This flaw affects btrfs filesystems using qgroups for quota management. The incorrect qgroup reservation handling occurs in an error recovery path when inline extent creation fails due to space pressure. While this can cause quota accounting inconsistencies, it requires specific conditions (qgroups enabled, ENOSPC during inline extent creation) and does not directly lead to code execution or data corruption.

Remediation:
CVE: CVE-2025-13711
Component: Tencent TFace eval Deserialization of Untrusted Data Remote Code Execution Vulnerability
Release date: 2025-12-01T22:45:10.393000+00:00

Tencent TFace eval Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent TFace. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the eval endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27187.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
CVE: CVE-2025-38441
Component: kernel
CWE: CWE-908
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()

syzbot found a potential access to uninit-value in nf_flow_pppoe_proto()

Blamed commit forgot the Ethernet header.

BUG: KMSAN: uninit-value in nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27
  nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27
  nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline]
  nf_hook_slow+0xe1/0x3d0 net/netfilter/core.c:623
  nf_hook_ingress include/linux/netfilter_netdev.h:34 [inline]
  nf_ingress net/core/dev.c:5742 [inline]
  __netif_receive_skb_core+0x4aff/0x70c0 net/core/dev.c:5837
  __netif_receive_skb_one_core net/core/dev.c:5975 [inline]
  __netif_receive_skb+0xcc/0xac0 net/core/dev.c:6090
  netif_receive_skb_internal net/core/dev.c:6176 [inline]
  netif_receive_skb+0x57/0x630 net/core/dev.c:6235
  tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485
  tun_get_user+0x4ee0/0x6b40 drivers/net/tun.c:1938
  tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1984
  new_sync_write fs/read_write.c:593 [inline]
  vfs_write+0xb4b/0x1580 fs/read_write.c:686
  ksys_write fs/read_write.c:738 [inline]
  __do_sys_write fs/read_write.c:749 [inline]


Remediation:
ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked
CVE: CVE-2025-21660
Component: kernel
Severity: None
Release date: 2025-01-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked

When `ksmbd_vfs_kern_path_locked` met an error and it is not the last
entry, it will exit without restoring changed path buffer. But later this
buffer may be used as the filename for creation.


Remediation:
drm/amdgpu: csa unmap use uninterruptible lock
CVE: CVE-2025-38011
Component: kernel
Severity: None
Release date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: csa unmap use uninterruptible lock

After process exit to unmap csa and free GPU vm, if signal is accepted
and then waiting to take vm lock is interrupted and return, it causes
memory leaking and below warning backtrace.

Change to use uninterruptible wait lock fix the issue.

WARNING: CPU: 69 PID: 167800 at amd/amdgpu/amdgpu_kms.c:1525
 amdgpu_driver_postclose_kms+0x294/0x2a0 [amdgpu]
 Call Trace:
  <TASK>
  drm_file_free.part.0+0x1da/0x230 [drm]
  drm_close_helper.isra.0+0x65/0x70 [drm]
  drm_release+0x6a/0x120 [drm]
  amdgpu_drm_release+0x51/0x60 [amdgpu]
  __fput+0x9f/0x280
  ____fput+0xe/0x20
  task_work_run+0x67/0xa0
  do_exit+0x217/0x3c0
  do_group_exit+0x3b/0xb0
  get_signal+0x14a/0x8d0
  arch_do_signal_or_restart+0xde/0x100
  exit_to_user_mode_loop+0xc1/0x1a0
  exit_to_user_mode_prepare+0xf4/0x100
  syscall_exit_to_user_mode+0x17/0x40
  do_syscall_64+0x69/0xc0

(cherry picked from commit 7dbbfb3c171a6f63b01165958629c9c26abf38ab)


Remediation:
PAM-PKCS#11 vulnerable to authentication bypass with default value for `cert_policy` (`none`)
CVE: CVE-2025-24032
Component: pam_pkcs11
CWE: CWE-287
Severity: Moderate
CVSS v3: 8.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Release date: 2025-02-10T15:43:47.166000+00:00

A flaw was found in the pam_pkcs11 Linux-PAM login module. If the `cert_policy` is set to none, which is the default value, then pam_pkcs11 will only check if the user is capable of logging into the token. This flaw allows an attacker to create a different token with the user's public data, for example, the user's certificate and a PIN known to the attacker. If no signature with the private key is required, the attacker can log in as a user with that created token.

Statement: This vulnerability is of moderate severity because it only applies when the configuration explicitly disables signature verification (cert_policy = none), which is not a secure best practice. The attack requires an adversary to create a fake token using the victim’s public certificate and a known PIN, but it does not compromise the private key itself. Since private key possession is typically required for strong authentication, systems enforcing proper certificate verification (including signature validation) remain unaffected. Additionally, RHEL is not vulnerable by default, further reducing the real-world impact.

Remediation:
Restrict the cert_policy value to `signature` in the pam_pkcs11.conf configuration file (`cert_policy = signature`).
use after free in GAMESSOutputFormat::ReadMolecule of the file gamessformat.cpp
CVE: CVE-2025-10994
Component: openbabel
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-09-26T02:02:07.422000+00:00

A use-after-free vulnerability has been identified in Open Babel. This affects the function GAMESSOutputFormat::ReadMolecule of the file gamessformat.cpp. This manipulation causes use after free. It is possible to launch the attack on the local host.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
virtio-net: zero unused hash fields
CVE: CVE-2025-40236
Component: kernel
Severity: None
Release date: 2025-12-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

virtio-net: zero unused hash fields

When GSO tunnel is negotiated virtio_net_hdr_tnl_from_skb() tries to
initialize the tunnel metadata but forget to zero unused rxhash
fields. This may leak information to another side. Fixing this by
zeroing the unused hash fields.


Remediation:
Improper Proxy Configuration Allows Unauthorized Administrative Commands
CVE: CVE-2025-11393
Component: insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator
CWE: CWE-441
Severity: Important
CVSS v3: 8.5/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Release date: 2025-12-15T00:00:00+00:00

A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle.

This allows a standard user within the cluster to send unauthorized commands to the management platform, effectively acting with the full permissions of the cluster administrator. This could lead to unauthorized changes to the cluster's configuration or status on the Red Hat platform.


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Add the following to the Cryostat or JWS subscription YAML:
> spec:
> config:
> env:
> - name: INSIGHTS_ENABLED
> value: "false"

This will disable the affected proxy server. (Note: due to a separate
issue, the above step will cause a crash loop in the Insights container
for the operator, but this is harmless).
smb: client: fix oops due to unset link speed
CVE: CVE-2025-21725
Component: kernel
CWE: CWE-369
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

A vulnerability was found in the Linux kernel's Server Message Block (SMB) client implementation, specifically within the Common Internet File System (CIFS) module. The issue arises when the client attempts to process network interface information provided by the server, particularly the LinkSpeed parameter. If the server omits this parameter or provides an unexpected value, the client may attempt to perform a division operation with a zero value, leading to a divide-by-zero error and subsequent kernel crash. This misconfiguration on the server could lead to system failure.


Remediation:
io_uring/zcrx: fix pp destruction warnings
CVE: CVE-2025-38504
Component: kernel
Severity: None
Release date: 2025-08-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

io_uring/zcrx: fix pp destruction warnings

With multiple page pools and in some other cases we can have allocated
niovs on page pool destruction. Remove a misplaced warning checking that
all niovs are returned to zcrx on io_pp_zc_destroy(). It was reported
before but apparently got lost.


Remediation:
duc: Stack Buffer Overflow in buffer_get function
CVE: CVE-2025-13654
Component: duc
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-05T12:42:21.027000+00:00

A stack buffer overflow vulnerability exists in the buffer_get function of duc, a disk management tool, where a condition can evaluate to true due to underflow, allowing an out-of-bounds read.

Statement: This vulnerability is rated Important for Red Hat products as it affects the `duc` package, available in Community Projects (EPEL and Fedora). A stack buffer overflow in the `buffer_get` function of `duc` can lead to an out-of-bounds read, potentially resulting in a denial of service. Exploitation does not require user interaction or elevated privileges.

Remediation:
To mitigate this issue, if the `duc` package is not required, it can be removed from the system. If `duc` functionality is necessary, restrict its use to trusted administrators and ensure it is executed in a controlled environment to limit potential exposure.
expr-eval: Prototype Pollution
CVE: CVE-2025-13204
Component: expr-eval
CWE: CWE-915
Severity: Important
CVSS v3: 7.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-11-14T17:02:39.529000+00:00

A prototype pollution flaw was found in expr-eval. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Linux kernel: Use-after-free in BPF sockmap can lead to denial of service and privilege escalation
CVE: CVE-2025-38154
Component: kernel
CWE: CWE-821
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-07-03T00:00:00+00:00

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) sockmap subsystem. A race condition exists where the `sk_socket` is not properly locked or referenced during the `skb_send_sock()` function call, allowing for a use-after-free vulnerability. This can be exploited by a local attacker, leading to a system crash (Denial of Service) and potentially enabling information disclosure or privilege escalation.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.