huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Node.js Rapidhash HashDoS Vulnerability
CVE: CVE-2025-27209
Component: nodejs
CWE: CWE-400
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-07-18T22:54:27.205000+00:00

A flaw was found in nodejs. The V8 component’s rapidhash implementation introduces a HashDoS vulnerability, allowing an attacker who can control the strings being hashed to trigger excessive CPU usage by generating numerous hash collisions. This exploitation vector results in an application level denial of service condition due to resource exhaustion.

Statement: The severity of this vulnerability is rated Moderate, as it does not impact system availability. The effects are confined to the application layer, without compromising the underlying system stability.

No Red Hat products or offerings are affected by this vulnerability.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
GStreamer Subparse NULL Pointer Dereference
CVE: CVE-2025-47808
Component: gstreamer1-plugins-base
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-08-07T00:00:00+00:00

A flaw was found in gstreamer1-plugins-base. The subparse plugin's tmplayer_parse_line function incorrectly attempts to dereference a NULL pointer during subtitle file parsing. This flaw allows a local attacker to provide a specially crafted subtitle file, causing the program to crash.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
nvme-multipath: fix lockdep WARN due to partition scan work
CVE: CVE-2025-68218
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nvme-multipath: fix lockdep WARN due to partition scan work

Blktests test cases nvme/014, 057 and 058 fail occasionally due to a
lockdep WARN. As reported in the Closes tag URL, the WARN indicates that
a deadlock can happen due to the dependency among disk->open_mutex,
kblockd workqueue completion and partition_scan_work completion.

To avoid the lockdep WARN and the potential deadlock, cut the dependency
by running the partition_scan_work not by kblockd workqueue but by
nvme_wq.


Remediation:
HashiCorp Vagrant Host Code Execution
CVE: CVE-2025-34075
Component: vagrant
Release date: 2025-07-02T19:26:01.774000+00:00

A virtual machine escape vector has been discovered in HashiCorp Vagrant. By design, Vagrant automatically mounts the host system’s project directory into the guest VM under /vagrant. This includes the Vagrantfile configuration file, which is a Ruby script evaluated by the host every time a vagrant command is executed in the project directory. If a low-privileged attacker obtains shell access to the guest VM, they can append arbitrary Ruby code to the mounted Vagrantfile.

Statement: Rejected as CVE due to documented, intended behavior that does not violate a claimed security boundary.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Processing maliciously crafted web content may lead to memory corruption
CVE: CVE-2025-31277
Component: webkitgtk
CWE: CWE-120
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.

Statement: To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.
Additionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded.

Remediation:
Do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
Kata Containers coco-tdx malicious host can circumvent initdata verification
CVE: CVE-2025-58354
Component: kata-containers
CWE: CWE-754
Severity: Moderate
CVSS v3: 7.3/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Release date: 2025-09-23T21:08:47.147000+00:00

A vulnerability has been identified in Kata Containers that allows a malicious host to bypass a critical security check designed to validate workloads. On systems using TDX technology for confidential computing, an attacker with control of the host system can intentionally disrupt operations to skip this verification process. This flaw allows the attacker to run unauthorized code inside a secure, isolated virtual environment while making the malicious software appear as a trusted application.

Statement: This vulnerability has been rated as having a Moderate severity by Red Hat Product Security team. This happens because of the limited impact in the availability and confidentiality caused by the exploitation of this flaw, additionally to be able to exploit this vulnerability the attacker needs to have host permission level.

In this flaw and attacker may force IO operations to fail, kata will apply the designated policies to the workload either way and the malicious workload will be successfully attested and will start impersonating an benign workload.

The exploitation of this vulnerability is possible only when the workload is using rootfs to host the guest binaries, if the binaries are present on a initrd it's not possible to the attacker to intercept the IO operations and cause it to fail.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ipv6: sr: Fix MAC comparison to be constant-time
CVE: CVE-2025-39702
Component: kernel
CWE: CWE-208
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2025-09-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ipv6: sr: Fix MAC comparison to be constant-time

To prevent timing attacks, MACs need to be compared in constant time.
Use the appropriate helper function for this.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
drm/tegra: nvdec: Fix dma_alloc_coherent error check
CVE: CVE-2025-38543
Component: kernel
CWE: CWE-252
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-16T00:00:00+00:00

A flaw was found in the tegra-drm module in the Linux kernel. When a DMA allocation fails, a missing return value check can cause a system crash and result in a denial of service.


Remediation:
CVE: CVE-2025-8643
Component: Kenwood DMX958XR Firmware Update Command Injection Vulnerability
Release date: 2025-08-06T01:13:49.310000+00:00

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26266.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
heap-based buffer overflow in jpeg2000dec
CVE: CVE-2025-9951
Component: FFmpeg
CVSS v3: 7.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Release date: 2025-09-09T13:54:08.497000+00:00

A flaw was found in the jpeg2000dec decoder in FFmpeg. Processing a specially crafted JPEG 2000 image can cause a heap-based buffer overflow, resulting in a denial of service or other undefined behavior.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
arp: use RCU protection in arp_xmit()
CVE: CVE-2025-21762
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

arp: use RCU protection in arp_xmit()

arp_xmit() can be called without RTNL or RCU protection.

Use RCU protection to avoid potential UAF.


Remediation:
Use-after-free in WebTransportChild
CVE: CVE-2025-1931
Component: firefox
CWE: CWE-416
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Release date: 2025-03-04T13:31:23.221000+00:00

It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash. This vulnerability affects Firefox < 136, Firefox ESR < 115.21, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
ACPI: CPPC: Fix NULL pointer dereference when nosmp is used
CVE: CVE-2025-38113
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ACPI: CPPC: Fix NULL pointer dereference when nosmp is used

With nosmp in cmdline, other CPUs are not brought up, leaving
their cpc_desc_ptr NULL. CPU0's iteration via for_each_possible_cpu()
dereferences these NULL pointers, causing panic.

Panic backtrace:

[    0.401123] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b8
...
[    0.403255] [<ffffffff809a5818>] cppc_allow_fast_switch+0x6a/0xd4
...
Kernel panic - not syncing: Attempted to kill init!

[ rjw: New subject ]


Remediation:
usb: typec: ucsi: Fix NULL pointer access
CVE: CVE-2025-21918
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: Fix NULL pointer access

Resources should be released only after all threads that utilize them
have been destroyed.
This commit ensures that resources are not released prematurely by waiting
for the associated workqueue to complete before deallocating them.


Remediation:
riscv: Fix kernel crash due to PR_SET_TAGGED_ADDR_CTRL
CVE: CVE-2025-37966
Component: kernel
Severity: None
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

riscv: Fix kernel crash due to PR_SET_TAGGED_ADDR_CTRL

When userspace does PR_SET_TAGGED_ADDR_CTRL, but Supm extension is not
available, the kernel crashes:

Oops - illegal instruction [#1]
    [snip]
epc : set_tagged_addr_ctrl+0x112/0x15a
 ra : set_tagged_addr_ctrl+0x74/0x15a
epc : ffffffff80011ace ra : ffffffff80011a30 sp : ffffffc60039be10
    [snip]
status: 0000000200000120 badaddr: 0000000010a79073 cause: 0000000000000002
    set_tagged_addr_ctrl+0x112/0x15a
    __riscv_sys_prctl+0x352/0x73c
    do_trap_ecall_u+0x17c/0x20c
    andle_exception+0x150/0x15c

Fix it by checking if Supm is available.


Remediation:
FFmpeg: Integer underflow in DHAV file header parsing leads to out-of-bounds read
CVE: CVE-2025-59729
Component: FFmpeg
CVSS v3: 7.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-10-06T08:08:46.060000+00:00

A flaw was found in FFmpeg. This vulnerability allows an out-of-bounds read via an integer underflow in the offset calculation when parsing the header for a Digital Home Audio/Video (DHAV) file.

Statement: The vulnerability in FFmpeg, an integer underflow leading to an out-of-bounds read during DHAV file header parsing, primarily impacts the availability of systems processing untrusted DHAV media files. Red Hat rates this as Moderate due to the potential for denial of service when processing specially crafted input.

Remediation:
Feast: Remote Code Execution via insecure YAML deserialization
CVE: CVE-2025-11157
Component: feast
CWE: CWE-502
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in Feast, specifically in the Kubernetes materializer job. An attacker with the ability to modify specific YAML configuration files can exploit an insecure deserialization vulnerability. This allows for the instantiation of arbitrary Python objects, leading to remote code execution on the worker pod. Successful exploitation could result in cluster takeover, data poisoning, and supply-chain sabotage.

Statement: This vulnerability is rated Important for Red Hat OpenShift AI because an attacker with low privileges and local access to the worker pod can modify specific YAML configuration files. This insecure deserialization allows for remote code execution, potentially leading to cluster takeover, data poisoning, and supply-chain sabotage. This affects Red Hat OpenShift AI versions 2.22, 2.25, and 3.0.

Remediation:
Implement strict access controls and least privilege principles for the Feast Kubernetes materializer job. Ensure that only authorized users and processes have write access to the `/var/feast/feature_store.yaml` and `/var/feast/materialization_config.yaml` files on the worker pods. This can be achieved through Kubernetes Role-Based Access Control (RBAC) policies and appropriate OpenShift security context constraints to limit file system access.
octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
CVE: CVE-2025-39978
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-10-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()

This code calls kfree_rcu(new_node, rcu) and then dereferences "new_node"
and then dereferences it on the next line.  Two lines later, we take
a mutex so I don't think this is an RCU safe region.  Re-order it to do
the dereferences before queuing up the free.


Remediation:
Phishing attack via email verification step in first login flow
CVE: CVE-2025-7365
Component: keycloak
CWE: CWE-346
Severity: Moderate
CVSS v3: 7.2/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-06-20T00:00:00+00:00

A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider (IdP) login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email address to match that of a victim's account, triggering a verification email sent to the victim's email address. The attacker's email address is not present in the verification email content, making it a potential phishing opportunity. If the victim clicks the verification link, the attacker can gain access to the victim's account.

Statement: To exploit this vulnerability, IdP must be configured in Keycloak and the attacker would require both a registered Keycloak and identity provider account. Additionally, an attacker would need to know the email or Keycloak username of the victim. Finally, the victim would need to accept the verification link within the 5 minutes that the token is active.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Disable account review in the Identity Provider to prevent users from potentially modifying identity information. Disable the email verification step and use only re-authentication step.
ipv6: use RCU in ip6_output()
CVE: CVE-2025-40158
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-11-12T00:00:00+00:00

A use-after-free flaw was found in ip6_finish_output2 in  net/ipv6/ip6_output.c in ipv6 access. This flaw could allow an attacker to crash the system at device disconnect. This vulnerability could even lead to a kernel information leak problem.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
firmware: arm_ffa: Fix memory leak by freeing notifier callback node
CVE: CVE-2025-38390
Component: kernel
Severity: None
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_ffa: Fix memory leak by freeing notifier callback node

Commit e0573444edbf ("firmware: arm_ffa: Add interfaces to request
notification callbacks") adds support for notifier callbacks by allocating
and inserting a callback node into a hashtable during registration of
notifiers. However, during unregistration, the code only removes the
node from the hashtable without freeing the associated memory, resulting
in a memory leak.

Resolve the memory leak issue by ensuring the allocated notifier callback
node is properly freed after it is removed from the hashtable entry.


Remediation:
Incus denial of service
CVE: CVE-2025-52889
Component: incus
CVSS v3: 2.5/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
Release date: 2025-06-25T16:49:00.442000+00:00

A DHCP pool management issue has been discovered in Incus. When using an ACL on a device connected to a bridge, a combination of nftables rules may cause available IP addresses to become exhausted.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.