huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
privilege escalation via the ast_coredumper script
CVE: CVE-2026-23741
Component: asterisk
CVSS v3: 8.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-02-06T16:47:19.611000+00:00

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the asterisk/contrib/scripts/ast_coredumper runs as root, as noted by the NOTES tag on line 689 of the ast_coredumper file. The script will source the contents of /etc/asterisk/ast_debug_tools.conf, which resides in a folder that is writeable by the asterisk user:group. Due to the /etc/asterisk/ast_debug_tools.conf file following bash semantics and it being loaded; an attacker with write permissions may add or modify the file such that when the root ast_coredumper is run; it would source and thereby execute arbitrary bash code found in the /etc/asterisk/ast_debug_tools.conf. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linux kernel: Memory leak in pnfs/flexfiles can lead to denial of service
CVE: CVE-2026-23038
Component: kernel
CWE: CWE-772
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-31T00:00:00+00:00

A flaw was found in the Linux kernel. A local user could exploit this flaw by triggering a specific condition in the nfs4_ff_alloc_deviceid_node() function within the pnfs/flexfiles module. This occurs because the dsaddrs list is not properly freed when the allocation for ds_versions fails. This memory leak could result in a Denial of Service (DoS) due to resource exhaustion.

Statement: A memory leak in pnfs flexfiles can occur in nfs4_ff_alloc_deviceid_node when allocation of ds_versions fails after dsaddrs has already been allocated. In that error path the function jumps to a cleanup label that does not drain the dsaddrs list which leaves an unreferenced allocation behind. Repeating the failing operation can accumulate leaked memory and may eventually cause a denial of service through resource exhaustion. For the CVSS the PR:H is typical because configuring and exercising pnfs flexfiles is usually limited to administrators and privileged services. The issue is not directly network reachable based on the patch context. Impact is availability only and is limited to memory consumption.

Remediation:
linkwatch: use __dev_put() in callers to prevent UAF
CVE: CVE-2026-23192
Component: kernel
CWE: CWE-911
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Release date: 2026-02-14T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel's linkwatch subsystem. When a network device is deleted while linkwatch events are pending, the device reference can be dropped prematurely in linkwatch_do_dev(), allowing netdev_run_todo() to free the device while __linkwatch_run_queue() still needs to access it, resulting in use-after-free.

Statement: This UAF can be triggered by rapidly toggling carrier state and deleting a network interface (demonstrated with TUN/TAP devices). The race window requires specific timing but is reproducible. While this could theoretically be exploited for code execution, the practical attack surface is limited to local users with network configuration privileges.

Remediation:
Next.js: null origin can bypass Server Actions CSRF checks
CVE: CVE-2026-27978
Component: next.js
CWE: CWE-346
Severity: Moderate
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2026-03-17T23:59:22.600000+00:00

A CSRF check bypass flaw has been discovered in Next.js. The `origin: null` was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (such as sandboxed iframes) could bypass origin verification instead of being validated as cross-origin requests. An attacker could induce a victim browser to submit Server Actions from a sandboxed context, potentially executing state-changing actions with victim credentials (CSRF).


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Keycloak: Missing Check on Disabled Client for Docker Registry Protocol
CVE: CVE-2026-2733
Component: org.keycloak/keycloak-services
CWE: CWE-285
Severity: Low
CVSS v3: 4.8/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Release date: 2026-02-19T00:00:00+00:00

A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously valid credentials can still be used to obtain authentication tokens. This weakens administrative controls and could allow unintended access to container registry resources.

Statement: The security impact of this vulnerability is rated as Low because successful exploitation requires valid user credentials and knowledge of the Docker client ID. While the issue does not allow privilege escalation beyond the authenticated user’s permissions, it undermines an important administrative control. By continuing to issue tokens for a disabled client, the system fails to properly enforce authorization state, potentially resulting in unintended access to protected container images.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue
CVE: CVE-2026-23203
Component: kernel
Severity: None
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue

Commit 1767bb2d47b7 ("ipv6: mcast: Don't hold RTNL for
IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.") removed the RTNL lock for
IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP operations. However, this
change triggered the following call trace on my BeagleBone Black board:
  WARNING: net/8021q/vlan_core.c:236 at vlan_for_each+0x120/0x124, CPU#0: rpcbind/496
  RTNL: assertion failed at net/8021q/vlan_core.c (236)
  Modules linked in:
  CPU: 0 UID: 997 PID: 496 Comm: rpcbind Not tainted 6.19.0-rc6-next-20260122-yocto-standard+ #8 PREEMPT
  Hardware name: Generic AM33XX (Flattened Device Tree)
  Call trace:
   unwind_backtrace from show_stack+0x28/0x2c
   show_stack from dump_stack_lvl+0x30/0x38
   dump_stack_lvl from __warn+0xb8/0x11c
   __warn from warn_slowpath_fmt+0x130/0x194
   warn_slowpath_fmt from vlan_for_each+0x120/0x124
   vlan_for_each from cpsw_add_mc_addr+0x54/0xd8
   cpsw_add_mc_addr from __hw_addr_ref_sync_dev+0xc4/0xec
   __hw_addr_ref_sync_dev from __dev_mc_add+0x78/0x88
   __dev_mc_add from igmp6_group_added+0x84/0xec
   igmp6_group_added from __ipv6_dev_mc_inc+0x1fc/0x2f0
   __ipv6_dev_mc_inc from __ipv6_sock_mc_join+0x124/0x1b4
   __ipv6_sock_mc_join from do_ipv6_setsockopt+0x84c/0x1168
   do_ipv6_setsockopt from ipv6_setsockopt+0x88/0xc8
   ipv6_setsockopt from do_sock_setsockopt+0xe8/0x19c
   do_sock_setsockopt from __sys_setsockopt+0x84/0xac
   __sys_setsockopt from ret_fast_syscall+0x0/0x5

This trace occurs because vlan_for_each() is called within
cpsw_ndo_set_rx_mode(), which expects the RTNL lock to be held.
Since modifying vlan_for_each() to operate without the RTNL lock is not
straightforward, and because ndo_set_rx_mode() is invoked both with and
without the RTNL lock across different code paths, simply adding
rtnl_lock() in cpsw_ndo_set_rx_mode() is not a viable solution.

To resolve this issue, we opt to execute the actual processing within
a work queue, following the approach used by the icssg-prueth driver.


Remediation:
Denial-of-service in the DOM: Service Workers component
CVE: CVE-2026-0889
Component: firefox
Severity: Low
CVSS v3: 3.3/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Release date: 2026-01-13T13:30:58.675000+00:00

Denial-of-service in the DOM: Service Workers component. This vulnerability affects Firefox < 147 and Thunderbird < 147.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
GIMP: Denial of service via crafted PSP image file
CVE: CVE-2026-2271
Component: gimp
CWE: CWE-190
Severity: Moderate
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-02-10T09:09:00+00:00

No description is available for this CVE.

Statement: This MODERATE impact flaw in GIMP's PSP image file parser can lead to an application level denial of service. The vulnerability occurs when processing a specially crafted PSP image, which can cause a heap overflow and out-of-bounds write.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
denial of service via concurrent map writes in OAuth2 state handling
CVE: CVE-2026-28789
Component: OliveTin
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-05T19:33:46.924000+00:00

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized access to a shared registeredStates map, causing a Go runtime panic (fatal error: concurrent map writes) and process termination. This allows remote attackers to crash the service when OAuth2 is enabled. This issue has been patched in version 3000.10.3.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
pypdf: Denial of Service via malformed PDF startxref entries
CVE: CVE-2026-22691
Component: pypdf
CWE: CWE-1050
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-01-10T04:46:12.423000+00:00

A flaw was found in pypdf. A remote attacker can exploit this vulnerability by crafting a malicious PDF file with malformed startxref entries and excessive whitespace characters. This can cause excessively long processing times when rebuilding the cross-reference table in non-strict reading mode, leading to a denial of service.

Statement: This vulnerability is rated MODERATE. The `pypdf` library, used in Red Hat Ansible Automation Platform, OpenShift Lightspeed, Red Hat Enterprise Linux AI, and Red Hat OpenShift AI, is susceptible to a denial of service when processing specially crafted PDF files in non-strict reading mode. An attacker could exploit this by providing a malicious PDF with malformed `startxref` entries and excessive whitespace, leading to prolonged processing times.

Remediation:
thunderbird: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component
CVE: CVE-2026-2764
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:03.207000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
JIT miscompilation, use-after-free in the JavaScript Engine: JIT component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
CVE: CVE-2026-0759
Component: Katana Network Development Starter Kit executeCommand Command Injection Remote Code Execution Vulnerability
Release date: 2026-01-09T16:29:37.995000+00:00

Katana Network Development Starter Kit executeCommand Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Katana Network Development Starter Kit. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the executeCommand method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27786.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak
CVE: CVE-2026-23080
Component: kernel
Severity: Moderate
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak

Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:
gs_usb_receive_bulk_callback(): fix URB memory leak").

In mcba_usb_probe() -> mcba_usb_start(), the URBs for USB-in transfers are
allocated, added to the priv->rx_submitted anchor and submitted. In the
complete callback mcba_usb_read_bulk_callback(), the URBs are processed and
resubmitted. In mcba_usb_close() -> mcba_urb_unlink() the URBs are freed by
calling usb_kill_anchored_urbs(&priv->rx_submitted).

However, this does not take into account that the USB framework unanchors
the URB before the complete function is called. This means that once an
in-URB has been completed, it is no longer anchored and is ultimately not
released in usb_kill_anchored_urbs().

Fix the memory leak by anchoring the URB in the
mcba_usb_read_bulk_callback()to the priv->rx_submitted anchor.


Remediation:
Blind Server-Side Request Forgery (SSRF) via CIBA Backchannel Notification Endpoint in Keycloak
CVE: CVE-2026-1518
Component: keycloak
CWE: CWE-918
Severity: Low
CVSS v3: 3.7/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Release date: 2026-01-28T00:00:00+00:00

A flaw was found in Keycloak’s CIBA feature where insufficient validation of client-configured backchannel notification endpoints could allow blind server-side requests to internal services.

Statement: This LOW impact flaw in Red Hat Build of Keycloak allows a highly privileged attacker to perform blind Server-Side Request Forgery (SSRF). By configuring the CIBA backchannel notification endpoint to an internal URL, an attacker can induce Keycloak to send requests to arbitrary internal services. Exploitation requires administrative access or a valid Initial Access Token to configure client settings.

Remediation:
To mitigate this issue, restrict administrative access to Keycloak instances. Ensure that only trusted and authorized personnel have the necessary privileges to configure client settings, including the backchannel_client_notification_endpoint. This limits the ability of an attacker to manipulate the endpoint for SSRF attacks.
x86/vmware: Fix hypercall clobbers
CVE: CVE-2026-23215
Component: kernel
CWE: CWE-131
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-18T00:00:00+00:00

A flaw was found in the Linux kernel's VMware guest support on x86_64 systems. When running under QEMU with VMware mouse emulation, the vmware_hypercall3() and vmware_hypercall4() functions do not properly mark the RDI and RSI registers as clobbered. The QEMU vmmouse driver incorrectly clears the upper 32 bits of these registers, causing kernel pointer truncation. This results in a page fault when the corrupted pointer is dereferenced, leading to a kernel crash.

Statement: This flaw is specific to x86_64 Linux guests running under QEMU with VMware mouse emulation enabled. While the root cause is a bug in QEMU's vmmouse implementation, the kernel workaround ensures compatibility with existing deployments. Physical hardware and other hypervisors are not affected.

Remediation:
CoreDNS: DNS access control bypass due to plugin execution order flaw
CVE: CVE-2026-26017
Component: github.com/coredns/coredns
CWE: CWE-367
Severity: Important
CVSS v3: 7.4/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Release date: 2026-03-06T15:36:15.655000+00:00

A flaw was found in CoreDNS, a DNS server that uses a chain of plugins. This logical vulnerability allows an attacker to bypass DNS access controls. The issue occurs because security plugins, such as 'acl', are evaluated before the 'rewrite' plugin, creating a Time-of-Check Time-of-Use (TOCTOU) flaw. This flaw enables an attacker to circumvent intended access restrictions.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
GnuPG: Denial of service due to specially crafted signature packet
CVE: CVE-2026-24883
Component: GnuPG
CWE: CWE-476
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-01-27T18:43:18.883000+00:00

A flaw was found in GnuPG. A remote attacker could provide a specially crafted long signature packet that, when processed, causes the application to crash. This vulnerability leads to a denial of service (DoS), making the GnuPG application unavailable to legitimate users.

Statement: This LOW impact vulnerability in GnuPG allows a remote attacker to trigger a denial of service. By processing a specially crafted long signature packet, the GnuPG application can crash, rendering it unavailable. This affects Red Hat Enterprise Linux and other products utilizing GnuPG.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Rollup: Remote Code Execution via Path Traversal Vulnerability
CVE: CVE-2026-27606
Component: rollup
CWE: CWE-22
Severity: Important
CVSS v3: 9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-02-25T02:08:06.682000+00:00

A flaw was found in Rollup, a JavaScript module bundler. Insecure file name sanitization in the core engine allows an attacker to control output filenames, potentially through command-line interface (CLI) inputs, manual chunk aliases, or malicious plugins. By using directory traversal sequences (`../`), an attacker can overwrite files anywhere on the host filesystem where the build process has write permissions. This vulnerability can lead to persistent remote code execution (RCE) by overwriting critical system or user configuration files.


Remediation:
See Kiali 1.73.28 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x
gpio: cdev: Fix resource leaks on errors in lineinfo_changed_notify()
CVE: CVE-2026-23079
Component: kernel
Severity: None
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

gpio: cdev: Fix resource leaks on errors in lineinfo_changed_notify()

On error handling paths, lineinfo_changed_notify() doesn't free the
allocated resources which results leaks.  Fix it.


Remediation:
tar: File overwrite via drive-relative symlink traversal
CVE: CVE-2026-31802
Component: tar
CWE: CWE-22
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2026-03-09T21:11:56.668000+00:00

A flaw was found in tar. An attacker can exploit this vulnerability by crafting a malicious tar archive containing a drive-relative symlink. This symlink, such as C:../../../target.txt, can trick the tar utility into writing files outside the intended extraction directory during normal archive extraction, leading to unauthorized file overwrite.

Statement: This is a MODERATE impact vulnerability. The tar utility is susceptible to unauthorized file overwrites when processing specially crafted archives containing drive-relative symlinks. As such, it primarily affects integrity (since it can overwrite files and file contents), with no clear indication that availability or confidentiality may be affected.

Remediation:
uacce: fix cdev handling in the cleanup path
CVE: CVE-2026-23096
Component: kernel
Severity: None
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

uacce: fix cdev handling in the cleanup path

When cdev_device_add fails, it internally releases the cdev memory,
and if cdev_device_del is then executed, it will cause a hang error.
To fix it, we check the return value of cdev_device_add() and clear
uacce->cdev to avoid calling cdev_device_del in the uacce_remove.


Remediation:
Inappropriate implementation in File input
CVE: CVE-2026-2322
Component: chromium-browser
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-02-10T00:00:00+00:00

Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
thunderbird: Use-after-free in the Audio/Video: Playback component
CVE: CVE-2026-2772
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:09.181000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Use-after-free in the Audio/Video: Playback component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)
CVE: CVE-2026-20897
Component: gitea
CWE: CWE-639
Severity: Critical
CVSS v3: 9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-01-22T22:01:51.508000+00:00

Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.


Remediation: