huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
LangChain: Arbitrary code execution via serialization injection
CVE: CVE-2025-68664
Component: langchain-core
CWE: CWE-502
Severity: Critical
CVSS v3: 9.3/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Release date: 2025-12-23T22:47:44.084000+00:00

A flaw was found in LangChain, a framework for building agents and LLM-powered applications. A remote attacker can exploit a serialization injection vulnerability in LangChain's `dumps()` and `dumpd()` functions. This occurs because the functions do not properly escape dictionaries containing the internal 'lc' key during serialization. When user-controlled data includes this key structure, it is incorrectly processed as a legitimate LangChain object during deserialization, potentially leading to arbitrary code execution.

Statement: This vulnerability is rated Critical for Red Hat products. A serialization injection flaw in LangChain's `dumps()` and `dumpd()` functions allows remote attackers to achieve arbitrary code execution. This occurs when user-controlled data containing the internal 'lc' key is improperly deserialized as a legitimate LangChain object.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.4#Installation%20and%20upgrade
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
CVE: CVE-2025-12491
Component: Senstar Symphony FetchStoredLicense Information Disclosure Vulnerability
Release date: 2025-12-10T17:51:00+00:00

Senstar Symphony FetchStoredLicense Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Senstar Symphony. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of FetchStoredLicense method. The issue results from the exposure of sensitive information. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-26908.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ext4: fix inode use after free in ext4_end_io_rsv_work()
CVE: CVE-2025-38580
Component: kernel
Severity: None
Release date: 2025-08-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix inode use after free in ext4_end_io_rsv_work()

In ext4_io_end_defer_completion(), check if io_end->list_vec is empty to
avoid adding an io_end that requires no conversion to the
i_rsv_conversion_list, which in turn prevents starting an unnecessary
worker. An ext4_emergency_state() check is also added to avoid attempting
to abort the journal in an emergency state.

Additionally, ext4_put_io_end_defer() is refactored to call
ext4_io_end_defer_completion() directly instead of being open-coded.
This also prevents starting an unnecessary worker when EXT4_IO_END_FAILED
is set but data_err=abort is not enabled.

This ensures that the check in ext4_put_io_end_defer() is consistent with
the check in ext4_end_bio(). Otherwise, we might add an io_end to the
i_rsv_conversion_list and then call ext4_finish_bio(), after which the
inode could be freed before ext4_end_io_rsv_work() is called, triggering
a use-after-free issue.


Remediation:
Privilege Escalation via Hook Initialization in NVIDIA Container Toolkit
CVE: CVE-2025-23266
Component: nvidia-container-toolkit
CWE: CWE-426
Severity: Important
CVSS v3: 8.8/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2025-07-17T19:08:21.352000+00:00

A flaw was found in the NVIDIA Container Toolkit. This vulnerability allows execution of arbitrary code with elevated permissions via improperly secured container initialization hooks. This can potentially lead to privilege escalation, data tampering, information disclosure, and denial of service.

Statement: RHEL AI is not affected because it uses CDI mode with NVIDIA Container Toolkit versions later than 1.17.5, which are not vulnerable, and does not rely on the enable-cuda-compat hook, thereby eliminating the attack vector entirely.

This vulnerability is marked as Important rather than Critical primarily due to its attack prerequisites and execution context, despite its high CVSS score. While the vulnerability allows privilege escalation via the enable-cuda-compat hook in the NVIDIA Container Toolkit, it is not exploitable remotely—it requires local access and low privileges within a containerized environment. This significantly reduces its initial attack surface compared to a truly critical vulnerability that could be exploited over the network without authentication.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
Libxml2 out of bounds read
CVE: CVE-2025-26434
Component: libxml2
CWE: CWE-120
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-09-05T16:10:02.497000+00:00

An out of bounds read flaw has been discovered in libxml2. This flaw could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.


Remediation:
ImageMagick use-after-free/double-free
CVE: CVE-2025-65955
Component: imagemagick
CWE: CWE-825
Severity: Moderate
CVSS v3: 4.8/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-12-02T23:02:58.856000+00:00

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.13-34, there is a vulnerability in ImageMagick’s Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. Clearing a font family calls RelinquishMagickMemory on _drawInfo->font, freeing the font string but leaving _drawInfo->font pointing to freed memory while _drawInfo->family is set to that (now-invalid) pointer. Any later cleanup or reuse of _drawInfo->font re-frees or dereferences dangling memory. DestroyDrawInfo and other setters (Options::font, Image::font) assume _drawInfo->font remains valid, so destruction or subsequent updates trigger crashes or heap corruption. This vulnerability is fixed in 7.1.2-9 and 6.9.13-34.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once
CVE: CVE-2025-40318
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-12-08T00:00:00+00:00

A use-after-free flaw was found in hci_cmd_sync_dequeue_once in net/bluetooth/hci_sync.c in Bluetooth: hci_sync in Linux Kernel. This vulnerability could even lead to a kernel information leak problem.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-50031
Component: WordPress DB Backup <= 6.0 - Broken Access Control Vulnerability
Release date: 2025-08-14T10:34:05.698000+00:00

Missing Authorization vulnerability in syedamirhussain91 DB Backup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects DB Backup: from n/a through 6.0.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Secure Boot does not automatically enable kernel lockdown
CVE: CVE-2025-1272
Component: kernel
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Release date: 2025-02-13T00:00:00+00:00

The Linux Kernel lockdown mode for kernel versions starting on 6.12 and above for Fedora Linux has the lockdown mode disabled without any warning. This may allow an attacker to gain access to sensitive information such kernel memory mappings, I/O ports, BPF and kprobes. Additionally unsigned modules can be loaded, leading to execution of untrusted code breaking breaking any Secure Boot protection. This vulnerability affects only Fedora Linux.

Statement: This flaw doesn't affect any supported Red Hat product, as the kernel versions as shipped by Red Hat do not include the commit which introduced the security regression.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
From CVEorg collector
CVE: CVE-2025-35998
Component: Intel (R)
CWE: CWE-1220
Severity: Important
CVSS v3: 7.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Release date: 2025-01-01T00:00:00+00:00

Missing protection mechanism for alternate hardware interface in the Intel® Quick Assist Technology for some Intel® Platforms within Ring 0: Kernel may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Statement: Actual for the Intel Xeon 6 with E-cores.
Firmware or microcode update could be required (using BIOS or using other utilities by administrator).
The bug accessible only to privileged users (like administrator can try to trigger it), so the impact is limited (means PR:H for the CVSS).

Remediation:
tee: optee: Fix supplicant wait loop
CVE: CVE-2025-21871
Component: kernel
CWE: CWE-667
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-03-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tee: optee: Fix supplicant wait loop

OP-TEE supplicant is a user-space daemon and it's possible for it
be hung or crashed or killed in the middle of processing an OP-TEE
RPC call. It becomes more complicated when there is incorrect shutdown
ordering of the supplicant process vs the OP-TEE client application which
can eventually lead to system hang-up waiting for the closure of the
client application.

Allow the client process waiting in kernel for supplicant response to
be killed rather than indefinitely waiting in an unkillable state. Also,
a normal uninterruptible wait should not have resulted in the hung-task
watchdog getting triggered, but the endless loop would.

This fixes issues observed during system reboot/shutdown when supplicant
got hung for some reason or gets crashed/killed which lead to client
getting hung in an unkillable state. It in turn lead to system being in
hung up state requiring hard power off/on to recover.


Remediation:
drm/xe: Make dma-fences compliant with the safe access rules
CVE: CVE-2025-38703
Component: kernel
CWE: CWE-826
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Make dma-fences compliant with the safe access rules

Xe can free some of the data pointed to by the dma-fences it exports. Most
notably the timeline name can get freed if userspace closes the associated
submit queue. At the same time the fence could have been exported to a
third party (for example a sync_fence fd) which will then cause an use-
after-free on subsequent access.

To make this safe we need to make the driver compliant with the newly
documented dma-fence rules. Driver has to ensure a RCU grace period
between signalling a fence and freeing any data pointed to by said fence.

For the timeline name we simply make the queue be freed via kfree_rcu and
for the shared lock associated with multiple queues we add a RCU grace
period before freeing the per GT structure holding the lock.

Statement: This vulnerability can in theory be triggered by a non-privileged user as the primary requirements are:
1. The ability to trigger normal GPU operations (ex. creating and closing submission queues);
2. Read/Write permissions granted via the `video` and `render` groups (fairly standard for most operating systems);
3. Intel GPU hardware.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Linux kernel: Denial of service in drm/xe/vm due to improper error handling
CVE: CVE-2025-39811
Component: kernel
CWE: CWE-825
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-09-16T00:00:00+00:00

A flaw was found in the Linux kernel's Direct Rendering Manager (DRM) subsystem, specifically within the xe/vm module. A local user could exploit improper error handling when clearing the scratch_pt pointer in the xe_vm_free_scratch() function. This could lead to a dereference of an error pointer during cleanup, potentially causing a system crash and resulting in a denial of service (DoS).


Remediation:
Parser unspecified vulnerability (CPU Jan 2025)
CVE: CVE-2025-21522
Component: mysql
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-21T20:53:05.137000+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser).  Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and  9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).


Remediation:
tee: fix register_shm_helper()
CVE: CVE-2025-40031
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tee: fix register_shm_helper()

In register_shm_helper(), fix incorrect error handling for a call to
iov_iter_extract_pages(). A case is missing for when
iov_iter_extract_pages() only got some pages and return a number larger
than 0, but not the requested amount.

This fixes a possible NULL pointer dereference following a bad input from
ioctl(TEE_IOC_SHM_REGISTER) where parts of the buffer isn't mapped.

Statement: The patch fixes a NULL pointer dereference in register_shm_helper() when iov_iter_extract_pages() returns a partial success (len > 0 but fewer pages than requested). The old code didn’t handle this case, leading to a possible NULL deref upon bad userspace input via ioctl(TEE_IOC_SHM_REGISTER) (e.g., partially unmapped buffers). Impact is local kernel crash/DoS only.

Remediation:
Use after free in DNS cache
CVE: CVE-2025-54588
Component: envoyproxy/envoy
CWE: CWE-416
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2025-09-03T00:00:00+00:00

A memory corruption flaw was discovered in how the Envoy proxy handles its DNS cache. This issue could allow a specific sequence of DNS lookups to cause the Envoy process to crash.


Remediation:
See Red Hat OpenShift Service Mesh 3.0.5 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0
See Red Hat OpenShift Service Mesh 3.1.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Linux kernel: Denial of Service due to invalid lock on device wedge in drm/xe
CVE: CVE-2025-38353
Component: kernel
CWE: CWE-414
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Fix taking invalid lock on wedge

If device wedges on e.g. GuC upload, the submission is not yet enabled
and the state is not even initialized. Protect the wedge call so it does
nothing in this case. It fixes the following splat:

	[] xe 0000:bf:00.0: [drm] device wedged, needs recovery
	[] ------------[ cut here ]------------
	[] DEBUG_LOCKS_WARN_ON(lock->magic != lock)
	[] WARNING: CPU: 48 PID: 312 at kernel/locking/mutex.c:564 __mutex_lock+0x8a1/0xe60
	...
	[] RIP: 0010:__mutex_lock+0x8a1/0xe60
	[]  mutex_lock_nested+0x1b/0x30
	[]  xe_guc_submit_wedge+0x80/0x2b0 [xe]


Remediation:
NetSurf uninitialized memory access
CVE: CVE-2025-45663
Component: netsurf
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2025-11-03T00:00:00+00:00

An issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating a dom_event structure.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
.NET and Visual Studio Remote Code Execution Vulnerability
CVE: CVE-2025-21172
Component: dotnet
CWE: CWE-641
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-01-14T18:04:38.469000+00:00

A remote code execution vulnerability was found in .NET. This flaw allows an attacker to load a specially crafted file in .NET.

Statement: This issue affects .NET Framework as shipped with all versions of RHEL. However, this flaw is not known to be exploitable under any supported scenario.

```

.NET 6.0 for RHEL-8, RHEL-9 and RHIVOS has reached its End of Life as of November 12, 2024, and is no longer supported. No fixes will be provided for this stream. For additional information about lifecycle for .NET on Red Hat Enterprise Linux, please refer to: https://access.redhat.com/support/policy/updates/net-core.

```

Remediation:
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
yt-dlp allows `--exec` command injection when using placeholder on Windows
CVE: CVE-2025-54072
Component: yt-dlp
CVSS v3: 7.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Release date: 2025-07-22T21:34:43.408000+00:00

An input sanitization flaw was found in yt-dlp. This flaw affects users on Windows platforms and may allow remote code execution.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Users may switch to an alternate operating system to avoid this issue.
x86/mm: Fix SMP ordering in switch_mm_irqs_off()
CVE: CVE-2025-40174
Component: kernel
CWE: CWE-772
Severity: Moderate
CVSS v3: 5.9/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-11-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

x86/mm: Fix SMP ordering in switch_mm_irqs_off()

Stephen noted that it is possible to not have an smp_mb() between
the loaded_mm store and the tlb_gen load in switch_mm(), meaning the
ordering against flush_tlb_mm_range() goes out the window, and it
becomes possible for switch_mm() to not observe a recent tlb_gen
update and fail to flush the TLBs.

[ dhansen: merge conflict fixed by Ingo ]


Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
QEMU SR-IOV Enable Mask Vulnerability
CVE: CVE-2025-54567
Component: qemu-kvm
CWE: CWE-684
Severity: Moderate
CVSS v3: 4.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2025-07-25T00:00:00+00:00

A flaw was found in QEMU. The PCIE SR-IOV emulation within QEMU incorrectly handles write masks for the VF Enable bit. This vulnerability allows an attacker with adjacent network access to trigger unexpected behavior. Mishandling occurs due to a logic error in hw/pci/pcie_sriov.c. Exploitation involves crafting a malicious network packet that can result in a denial of service.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.