huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Wireshark: Denial of Service via SOME/IP-SD protocol dissector crash
CVE: CVE-2026-0962
Component: Wireshark
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.2/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-01-14T20:23:38.829000+00:00

A flaw was found in Wireshark. A remote attacker could entice a user to open a specially crafted packet capture file. This action would trigger a crash in the SOME/IP-SD protocol dissector, leading to a Denial of Service (DoS) for the affected system.

Statement: This vulnerability is rated Moderate for Red Hat. An out-of-bounds write in the Wireshark SOME/IP-SD protocol dissector can lead to a denial of service. Exploitation requires user interaction, as a victim must open a specially crafted packet trace file or capture malicious network traffic. Impact is limited to systems where Wireshark is installed and actively used to process untrusted network captures.

Remediation:
To mitigate this issue, avoid opening untrusted capture files or analyzing untrusted live network traffic with Wireshark. Users should only process network data from known and trusted sources. If Wireshark is not actively used, consider removing the package to reduce the attack surface.
RDMA/siw: Fix potential NULL pointer dereference in header processing
CVE: CVE-2026-23242
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the Linux kernel's Software iWARP (siw) RDMA driver. In siw_tcp_rx_data(), when siw_get_hdr() returns -EINVAL before set_rx_fpdu_context() is called, the qp->rx_fpdu pointer remains NULL. The error handling path then dereferences qp->rx_fpdu->more_ddp_segs without a NULL check, causing a kernel crash.

Statement: This flaw affects systems using the Software iWARP (siw) driver for RDMA over TCP. The NULL pointer dereference can be triggered during header processing when receiving malformed RDMA packets. The siw driver is typically used in development or testing environments rather than production RDMA deployments which usually use hardware RDMA adapters.

Remediation:
To mitigate this issue, prevent the siw module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.
FreeRDP: Denial of Service due to use-after-free vulnerability in window handling
CVE: CVE-2026-25953
Component: freerdp
CWE: CWE-825
Severity: Moderate
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-02-25T20:27:00.424000+00:00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reads from a freed `xfAppWindow` because the RDPGFX DVC thread obtains a bare pointer via `xf_rail_get_window` without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order. Version 3.23.0 fixes the issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
binder: fix UAF in binder_netlink_report()
CVE: CVE-2026-23184
Component: kernel
Severity: None
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

binder: fix UAF in binder_netlink_report()

Oneway transactions sent to frozen targets via binder_proc_transaction()
return a BR_TRANSACTION_PENDING_FROZEN error but they are still treated
as successful since the target is expected to thaw at some point. It is
then not safe to access 't' after BR_TRANSACTION_PENDING_FROZEN errors
as the transaction could have been consumed by the now thawed target.

This is the case for binder_netlink_report() which derreferences 't'
after a pending frozen error, as pointed out by the following KASAN
report:

  ==================================================================
  BUG: KASAN: slab-use-after-free in binder_netlink_report.isra.0+0x694/0x6c8
  Read of size 8 at addr ffff00000f98ba38 by task binder-util/522

  CPU: 4 UID: 0 PID: 522 Comm: binder-util Not tainted 6.19.0-rc6-00015-gc03e9c42ae8f #1 PREEMPT
  Hardware name: linux,dummy-virt (DT)
  Call trace:
   binder_netlink_report.isra.0+0x694/0x6c8
   binder_transaction+0x66e4/0x79b8
   binder_thread_write+0xab4/0x4440
   binder_ioctl+0x1fd4/0x2940
   [...]

  Allocated by task 522:
   __kmalloc_cache_noprof+0x17c/0x50c
   binder_transaction+0x584/0x79b8
   binder_thread_write+0xab4/0x4440
   binder_ioctl+0x1fd4/0x2940
   [...]

  Freed by task 488:
   kfree+0x1d0/0x420
   binder_free_transaction+0x150/0x234
   binder_thread_read+0x2d08/0x3ce4
   binder_ioctl+0x488/0x2940
   [...]
  ==================================================================

Instead, make a transaction copy so the data can be safely accessed by
binder_netlink_report() after a pending frozen error. While here, add a
comment about not using t->buffer in binder_netlink_report().


Remediation:
OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing
CVE: CVE-2026-22795
Component: openssl
CWE: CWE-843
Severity: Low
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-01-27T00:00:00+00:00

A flaw was found in OpenSSL. This type confusion vulnerability allows a remote attacker to cause a Denial of Service (DoS) by tricking a user or application into processing a maliciously crafted PKCS#12 (Personal Information Exchange Syntax Standard) file. The vulnerability leads to an invalid or NULL pointer dereference, resulting in an application crash.

Statement: This vulnerability is rated Low for Red Hat products. An application processing a maliciously crafted PKCS#12 file can be caused to dereference an invalid or NULL pointer, resulting in a Denial of Service. In the Red Hat context, impact is limited as PKCS#12 files are typically used for trusted private keys and are not commonly accepted from untrusted sources.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
The Insights proxy container image provided here is downloaded by the Red Hat
Insights proxy product RPM.

Before applying this update, make sure all previously released errata relevant to
your system have been applied.
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Giflib: Double-free vulnerability leading to memory corruption
CVE: CVE-2026-23868
Component: giflib
CWE: CWE-825
Severity: Important
CVSS v3: 6.9/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-10T18:53:25.606000+00:00

A flaw was found in giflib. This double-free vulnerability, caused by a shallow copy in GifMakeSavedImage and incorrect error handling, may allow an attacker to corrupt memory. While difficult to trigger, successful exploitation could potentially lead to arbitrary code execution or a denial of service.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
FreeRDP: Denial of service due to use-after-free vulnerability
CVE: CVE-2026-25952
Component: freerdp
CWE: CWE-825
Severity: Moderate
CVSS v3: 6.3/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
Release date: 2026-02-25T20:24:07.396000+00:00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
wifi: iwlwifi: mld: cancel mlo_scan_start_wk
CVE: CVE-2026-23185
Component: kernel
CWE: CWE-772
Severity: Important
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mld: cancel mlo_scan_start_wk

mlo_scan_start_wk is not canceled on disconnection. In fact, it is not
canceled anywhere except in the restart cleanup, where we don't really
have to.

This can cause an init-after-queue issue: if, for example, the work was
queued and then drv_change_interface got executed.

This can also cause use-after-free: if the work is executed after the
vif is freed.


Remediation:
Exiv2: Denial of Service via out-of-bounds read in preview component
CVE: CVE-2026-27596
Component: exiv2
Severity: Low
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-02T19:40:48.559000+00:00

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found in Exiv2. The vulnerability is in the preview component, which is only triggered when running Exiv2 with an extra command line argument, like -pp. The out-of-bounds read is at a 4GB offset, which usually causes Exiv2 to crash. This issue has been patched in version 0.28.8.

Statement: This is a LOW impact flaw in Exiv2. The vulnerability in the preview component is only triggered when the `exiv2` utility is executed with the `-pp` command-line argument.

Remediation:
dnf5: Denial of Service via path traversal in D-Bus locale configuration
CVE: CVE-2026-3836
Component: dnf5
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-09T12:34:00+00:00

A flaw was found in dnf5. A local, unprivileged attacker can exploit a path traversal vulnerability in the D-Bus locale configuration. By providing a specially crafted string to the locale key during session opening, the attacker can force the dnf5daemon-server to terminate, leading to an application-level Denial of Service (DoS) with a core dump.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Signed to Unsigned Conversion Error Leading to Stack-Based Buffer Overflow in libsoup NTLM Authentication
CVE: CVE-2026-0719
Component: libsoup
CWE: CWE-121
Severity: Important
CVSS v3: 8.6/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Release date: 2026-01-08T00:00:00+00:00

A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers. This results in incorrect memory allocation on the stack, followed by unsafe memory copying. As a result, applications using libsoup may crash unexpectedly, creating a denial-of-service risk.

Statement: The Red Hat Product Security team has assessed this vulnerability as Important severity due to its remote exploitability and lack of authentication requirements. Successful exploitation allows an attacker to crash any client or service using libsoup’s NTLM authentication mechanism. The root cause is improper handling of signed integer arithmetic, which leads to stack buffer overflow and denial-of-service.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID
CVE: CVE-2026-23490
Component: pyasn1
CWE: CWE-770
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-16T19:03:36.442000+00:00

A flaw was found in pyasn1, a generic ASN.1 library for Python. A remote attacker could exploit this vulnerability by sending a specially crafted RELATIVE-OID with excessive continuation octets. This input validation vulnerability leads to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.


Remediation:
For details on how to apply this update, refer to Ansible Automation Platform documentation.
For details on how to apply this update, refer to Ansible Automation Platform documentation.
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
Next.js: Unbounded next/image disk cache growth can exhaust storage
CVE: CVE-2026-27980
Component: next.js
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-18T00:23:34.862000+00:00

An unbounded disk usage flaw has been discovered in Next.js. The default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Linux kernel: Denial of service and memory corruption in RDMA umad
CVE: CVE-2026-23243
Component: kernel
CWE: CWE-131
Severity: Moderate
CVSS v3: 7.5/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) `umad` (User Mode Access Device) component. A local user can exploit this vulnerability by manipulating input, causing an integer underflow that leads to an out-of-bounds memory write. This memory corruption can result in a denial of service (DoS) by crashing the system, and may also lead to limited information disclosure or data integrity issues.

Statement: This bug is a kernel out-of-bounds write in the RDMA umad write path caused by a user-controlled length calculation that could underflow and pass an invalid data_len into MAD send buffer creation.
A local user with access to the umad interface can trigger the issue by supplying mismatched MAD and RMPP header sizes, which leads to an out-of-bounds memset in the send MAD allocation path and can corrupt kernel memory.

Remediation:
To mitigate this issue, prevent module ib_umad from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Missing Authorization Check Allows Unprivileged Users to Back Up LUKS Headers via udisks D-Bus API
CVE: CVE-2026-26104
Component: udisks
CWE: CWE-862
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-02-25T06:00:00+00:00

A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitive cryptographic metadata can be read and written to attacker-controlled locations. This weakens the confidentiality guarantees of encrypted storage volumes.

Statement: The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate. Exploitation requires local access but no authentication or user interaction. Successful exploitation enables unauthorized disclosure of LUKS encryption metadata, which may assist offline password-cracking or cryptographic analysis attacks. The vulnerability is caused by a missing authorization check on a privileged D-Bus method that performs sensitive read operations.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to a widespread installation base, or stability.
Use after free in WindowDialog
CVE: CVE-2026-3924
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-10T00:00:00+00:00

An use after free flaw was found in the WindowDialog component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=487338366

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
ALSA: scarlett2: Fix buffer overflow in config retrieval
CVE: CVE-2026-23078
Component: kernel
CWE: CWE-131
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A heap buffer overflow vulnerability was found in the Linux kernel's ALSA scarlett2 driver for Focusrite Scarlett audio interfaces. The scarlett2_usb_get_config() function incorrectly checks the total buffer size instead of element size when performing endianness conversion. When count is greater than 1, the loop accesses count*2 bytes while only size bytes are allocated, causing a buffer overflow.

Statement: This vulnerability affects systems with Focusrite Scarlett USB audio interfaces. The buffer overflow occurs during configuration retrieval from the device and could potentially be exploited for kernel memory corruption. Practical exploitation requires a malicious or specially crafted USB device response.

Remediation:
To mitigate this issue, prevent the snd_usb_audio module from being loaded if USB audio devices are not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.
Cap'n Proto has an integer overflow in KJ-HTTP
CVE: CVE-2026-32239
Component: capnproto
CWE: CWE-681
Severity: Moderate
CVSS v3: 4.7/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2026-03-12T19:33:25.052000+00:00

A flaw was found in the KJ-HTTP component of Cap’n Proto. When processing HTTP messages, a negative Content-Length value could be implicitly converted to an unsigned integer, resulting in an extremely large length value. An attacker could exploit this behavior by sending specially crafted HTTP messages containing negative Content-Length values. This may lead to inconsistent interpretation of HTTP message boundaries and could theoretically enable HTTP request or response smuggling scenarios in applications that rely on Cap’n Proto’s HTTP implementation.

Statement: This issue is rated Moderate severity by Red Hat Product Security, because exploitation requires the attacker to craft malformed HTTP messages containing negative Content-Length values that trigger the integer conversion behavior in the KJ-HTTP parser. Such malformed inputs are not typically generated during normal HTTP communication and may be rejected or normalized by intermediate HTTP components such as proxies or load balancers or front-end servers before reaching the affected parser. The potential impact is also limited to inconsistent interpretation of HTTP request boundaries, which could enable limited request smuggling scenarios depending on application architecture. The vulnerability does not directly allow remote code execution or service crashes.

Remediation:
Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.
Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration
CVE: CVE-2026-23097
Component: kernel
CWE: CWE-833
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Release date: 2026-02-04T00:00:00+00:00

A flaw was found in the Linux kernel. A local attacker could exploit a deadlock vulnerability due to incorrect lock ordering between folio_lock and i_mmap_rwsem when migrating hugetlb file-backed folios. This could lead to hung tasks and potential system-wide stalls, resulting in a Denial of Service (DoS).

Statement: A deadlock can occur when migrating hugetlb file backed folios due to incorrect lock ordering between folio_lock and the mapping i_mmap_rwsem. One task in the migration path can hold folio_lock and then block on i_mmap_lock_read. Another task such as hugetlbfs fallocate or punch hole can hold i_mmap_lock_write and then block on folio_lock. This ABBA pattern can hang tasks indefinitely and lead to a denial of service. For the CVSS the PR is N because the involved operations can be triggered by normal users who can access hugetlbfs and run memory pressure and file operations. The issue is not network reachable. Impact is denial of service due to hung tasks and potential system wide stalls.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Inappropriate implementation in Downloads
CVE: CVE-2026-2323
Component: chromium-browser
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-02-10T00:00:00+00:00

Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
thunderbird: Incorrect boundary conditions in the Web Audio component
CVE: CVE-2026-2773
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:10.177000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Incorrect boundary conditions in the Web Audio component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation: