huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
clk: samsung: Fix UBSAN panic in samsung_clk_init()
CVE: CVE-2025-39728
Component: kernel
CWE: CWE-129
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

clk: samsung: Fix UBSAN panic in samsung_clk_init()

With UBSAN_ARRAY_BOUNDS=y, I'm hitting the below panic due to
dereferencing `ctx->clk_data.hws` before setting
`ctx->clk_data.num = nr_clks`. Move that up to fix the crash.

  UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP
  <snip>
  Call trace:
   samsung_clk_init+0x110/0x124 (P)
   samsung_clk_init+0x48/0x124 (L)
   samsung_cmu_register_one+0x3c/0xa0
   exynos_arm64_register_cmu+0x54/0x64
   __gs101_cmu_top_of_clk_init_declare+0x28/0x60
   ...


Remediation:
thunderbird: Fullscreen notification is not displayed when fullscreen is re-requested
CVE: CVE-2025-1018
Component: firefox
CWE: CWE-451
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2025-02-04T13:58:52.807000+00:00

The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential spoofing attack. This vulnerability affects Firefox < 135 and Thunderbird < 135.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
ns: initialize ns_list_node for initial namespaces
CVE: CVE-2025-68377
Component: kernel
Severity: None
Release date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ns: initialize ns_list_node for initial namespaces

Make sure that the list is always initialized for initial namespaces.


Remediation:
Chrome Media Use-After-Free Vulnerability
CVE: CVE-2025-5958
Component: chromium
CVSS v3: 8.6/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-06-11T00:54:26.301000+00:00

A use-after-free vulnerability has been identified in the Chromium Media component. This flaw allows a remote attacker to trigger heap corruption by enticing a user to interact with a specially crafted HTML page. Successful exploitation of this vulnerability can enable an attacker to manipulate memory contents, leading to unpredictable program behavior, potential execution of arbitrary code, or a denial-of-service condition within the context of the user's browser.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
tls: fix handling of zero-length records on the rx_list
CVE: CVE-2025-39682
Component: kernel
Severity: Moderate
CVSS v3: 6.9/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-09-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tls: fix handling of zero-length records on the rx_list

Each recvmsg() call must process either
 - only contiguous DATA records (any number of them)
 - one non-DATA record

If the next record has different type than what has already been
processed we break out of the main processing loop. If the record
has already been decrypted (which may be the case for TLS 1.3 where
we don't know type until decryption) we queue the pending record
to the rx_list. Next recvmsg() will pick it up from there.

Queuing the skb to rx_list after zero-copy decrypt is not possible,
since in that case we decrypted directly to the user space buffer,
and we don't have an skb to queue (darg.skb points to the ciphertext
skb for access to metadata like length).

Only data records are allowed zero-copy, and we break the processing
loop after each non-data record. So we should never zero-copy and
then find out that the record type has changed. The corner case
we missed is when the initial record comes from rx_list, and it's
zero length.

Statement: A logic bug in the kTLS receive path mishandles zero-length records taken from the rx_list, allowing a mixed record-type sequence to slip past the per-recvmsg() type constraint and proceed to data processing. The fix initializes and checks the per-call content type (using 0 as “unset”) and bails out when a non-DATA record is encountered after DATA. This can be remotely triggered only when kernel TLS (CONFIG_TLS with the TLS ULP) is in use.
This issue can only be triggered when the kernel TLS ULP (kTLS, enabled via CONFIG_TLS and attached to TCP sockets with SOL_TLS) is in use

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
ntfs3: Fix uninit buffer allocated by __getname()
CVE: CVE-2025-68727
Component: kernel
Severity: None
Release date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: Fix uninit buffer allocated by __getname()

Fix uninit errors caused after buffer allocation given to 'de'; by
initializing the buffer with zeroes. The fix was found by using KMSAN.


Remediation:
netfs: Fix oops in write-retry from mis-resetting the subreq iterator
CVE: CVE-2025-38139
Component: kernel
Severity: None
Release date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix oops in write-retry from mis-resetting the subreq iterator

Fix the resetting of the subrequest iterator in netfs_retry_write_stream()
to use the iterator-reset function as the iterator may have been shortened
by a previous retry.  In such a case, the amount of data to be written by
the subrequest is not "subreq->len" but "subreq->len -
subreq->transferred".

Without this, KASAN may see an error in iov_iter_revert():

   BUG: KASAN: slab-out-of-bounds in iov_iter_revert lib/iov_iter.c:633 [inline]
   BUG: KASAN: slab-out-of-bounds in iov_iter_revert+0x443/0x5a0 lib/iov_iter.c:611
   Read of size 4 at addr ffff88802912a0b8 by task kworker/u32:7/1147

   CPU: 1 UID: 0 PID: 1147 Comm: kworker/u32:7 Not tainted 6.15.0-rc6-syzkaller-00052-g9f35e33144ae #0 PREEMPT(full)
   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
   Workqueue: events_unbound netfs_write_collection_worker
   Call Trace:
    <TASK>
    __dump_stack lib/dump_stack.c:94 [inline]
    dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
    print_address_description mm/kasan/report.c:408 [inline]
    print_report+0xc3/0x670 mm/kasan/report.c:521
    kasan_report+0xe0/0x110 mm/kasan/report.c:634
    iov_iter_revert lib/iov_iter.c:633 [inline]
    iov_iter_revert+0x443/0x5a0 lib/iov_iter.c:611
    netfs_retry_write_stream fs/netfs/write_retry.c:44 [inline]
    netfs_retry_writes+0x166d/0x1a50 fs/netfs/write_retry.c:231
    netfs_collect_write_results fs/netfs/write_collect.c:352 [inline]
    netfs_write_collection_worker+0x23fd/0x3830 fs/netfs/write_collect.c:374
    process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3238
    process_scheduled_works kernel/workqueue.c:3319 [inline]
    worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
    kthread+0x3c2/0x780 kernel/kthread.c:464
    ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
    </TASK>


Remediation:
FluidSynth: Denial of Service via invalid MIDI file processing
CVE: CVE-2025-56225
Component: fluidsynth
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in FluidSynth, a software synthesizer. A local attacker, or an attacker who can trick a user into opening a specially crafted, invalid MIDI (Musical Instrument Digital Interface) file, could trigger a Null pointer dereference. This vulnerability can cause the application to crash, leading to a Denial of Service (DoS).

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Inappropriate implementation in WebRTC
CVE: CVE-2025-13639
Component: chromium-browser
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-12-02T19:00:15.900000+00:00

Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Low)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
benet: fix BUG when creating VFs
CVE: CVE-2025-38569
Component: kernel
CWE: CWE-763
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

benet: fix BUG when creating VFs

benet crashes as soon as SRIOV VFs are created:

 kernel BUG at mm/vmalloc.c:3457!
 Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
 CPU: 4 UID: 0 PID: 7408 Comm: test.sh Kdump: loaded Not tainted 6.16.0+ #1 PREEMPT(voluntary)
 [...]
 RIP: 0010:vunmap+0x5f/0x70
 [...]
 Call Trace:
  <TASK>
  __iommu_dma_free+0xe8/0x1c0
  be_cmd_set_mac_list+0x3fe/0x640 [be2net]
  be_cmd_set_mac+0xaf/0x110 [be2net]
  be_vf_eth_addr_config+0x19f/0x330 [be2net]
  be_vf_setup+0x4f7/0x990 [be2net]
  be_pci_sriov_configure+0x3a1/0x470 [be2net]
  sriov_numvfs_store+0x20b/0x380
  kernfs_fop_write_iter+0x354/0x530
  vfs_write+0x9b9/0xf60
  ksys_write+0xf3/0x1d0
  do_syscall_64+0x8c/0x3d0

be_cmd_set_mac_list() calls dma_free_coherent() under a spin_lock_bh.
Fix it by freeing only after the lock has been released.


Remediation:
ksmbd: fix integer overflows on 32 bit systems
CVE: CVE-2025-21748
Component: kernel
CWE: CWE-190
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix integer overflows on 32 bit systems

On 32bit systems the addition operations in ipc_msg_alloc() can
potentially overflow leading to memory corruption.
Add bounds checking using KSMBD_IPC_MAX_PAYLOAD to avoid overflow.


Remediation:
CVE: CVE-2025-14406
Component: Soda PDF Desktop Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
Release date: 2025-12-11T20:46:38.212000+00:00

Soda PDF Desktop Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Soda PDF Desktop. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-25793.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Arbitrary code execution during build on darwin in cmd/go
CVE: CVE-2025-22867
Component: cmd/go
CWE: CWE-94
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2025-02-06T17:09:56.893000+00:00

A vulnerability was found in the cmd/go golang package. On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld due to usage of the @executable_path, @loader_path, or @rpath special values in a "#cgo LDFLAGS" directive.

Statement: This issue only affects go1.24rc2. The go1.24rc2 version is not used in any of the Red Hat products, therefore, Red Hat is not affected by this vulnerability.

Remediation:
No mitigation is available for this issue other than updating the affected package to the version containing the fix.
arm64: dts: qcom: x1e80100: Add GPU cooling
CVE: CVE-2025-38093
Component: kernel
Severity: None
Release date: 2025-07-02T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

arm64: dts: qcom: x1e80100: Add GPU cooling

Unlike the CPU, the GPU does not throttle its speed automatically when it
reaches high temperatures. With certain high GPU loads it is possible to
reach the critical hardware shutdown temperature of 120°C, endangering the
hardware and making it impossible to run certain applications.

Set up GPU cooling similar to the ACPI tables, by throttling the GPU speed
when reaching 95°C and polling every 200ms.


Remediation:
Linux kernel: Denial of Service in ARM64 BPF JIT due to improper frame pointer initialization
CVE: CVE-2025-38586
Component: kernel
CWE: CWE-908
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bpf, arm64: Fix fp initialization for exception boundary

In the ARM64 BPF JIT when prog->aux->exception_boundary is set for a BPF
program, find_used_callee_regs() is not called because for a program
acting as exception boundary, all callee saved registers are saved.
find_used_callee_regs() sets `ctx->fp_used = true;` when it sees FP
being used in any of the instructions.

For programs acting as exception boundary, ctx->fp_used remains false
even if frame pointer is used by the program and therefore, FP is not
set-up for such programs in the prologue. This can cause the kernel to
crash due to a pagefault.

Fix it by setting ctx->fp_used = true for exception boundary programs as
fp is always saved in such programs.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
xwayland: Out-of-bounds write in CreatePointerBarrierClient()
CVE: CVE-2025-26598
Component: xorg
CWE: CWE-787
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-02-25T00:00:00+00:00

An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching device ID is found, which can lead to out-of-bounds memory access.

Statement: Xorg server does not run with root privileges in Red Hat Enterprise Linux 8 and 9, therefore, Red Hat Enterprise Linux 8 and 9 have been rated with a Moderate severity and are not affected by this bug.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-2771
Component: BEC Technologies Multiple Routers Authentication Bypass Vulnerability
Release date: 2025-03-25T23:23:10.590000+00:00

BEC Technologies Multiple Routers Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of BEC Technologies routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the web-based user interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25894.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linux kernel: Denial of Service in veth due to race condition
CVE: CVE-2025-68232
Component: kernel
CWE: CWE-367
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-16T00:00:00+00:00

A flaw was found in the Linux kernel's virtual Ethernet device (veth) component. A race condition within the `veth_xmit()` function, caused by an incorrect use of an internal API, can lead to the transmit queue (TXQ) becoming permanently stalled. This issue can result in a Denial of Service (DoS) where network traffic halts on affected systems.


Remediation:
Use after free in Dawn
CVE: CVE-2025-10500
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-09-24T16:17:12.209000+00:00

A Use after free issue has been identified in Dawn in Google Chrome that allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Sensitive Cookie(s) Set Without Security Flags
CVE: CVE-2025-53861
Component: aap
CWE: CWE-319
Severity: Low
CVSS v3: 3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-07-10T00:00:00+00:00

A flaw was found in Ansible. Sensitive cookies without security flags over non-encrypted channels can lead to Man-in-the-Middle (MitM) and Cross-site scripting (XSS) attacks allowing attackers to read transmitted data.


Remediation:
Open Asset Import Library Assimp File SceneCombiner.cpp AddNodeHashes out-of-bounds
CVE: CVE-2025-3160
Component: assimp
CWE: CWE-125
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-04-03T14:31:06.940000+00:00

A flaw has been found in the Open Asset Import Library (assimp). In affected versions, a maliciously crafted file may trigger a heap-based buffer overflow, which may lead to an application crash or other undefined behavior.


Remediation:
netfilter: socket: Lookup orig tuple for IPv6 SNAT
CVE: CVE-2025-22021
Component: kernel
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: socket: Lookup orig tuple for IPv6 SNAT

nf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to
restore the original 5-tuple in case of SNAT, to be able to find the
right socket (if any). Then socket_match() can correctly check whether
the socket was transparent.

However, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this
conntrack lookup, making xt_socket fail to match on the socket when the
packet was SNATed. Add the same logic to nf_sk_lookup_slow_v6.

IPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as
pods' addresses are in the fd00::/8 ULA subnet and need to be replaced
with the node's external address. Cilium leverages Envoy to enforce L7
policies, and Envoy uses transparent sockets. Cilium inserts an iptables
prerouting rule that matches on `-m socket --transparent` and redirects
the packets to localhost, but it fails to match SNATed IPv6 packets due
to that missing conntrack lookup.


Remediation:
FFmpeg: Integer overflow vulnerability leads to Denial of Service
CVE: CVE-2025-63757
Component: ffmpeg
CWE: CWE-190
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-18T00:00:00+00:00

Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0.

Statement: This vulnerability is rated Important for Red Hat products. An integer overflow in FFmpeg's `yuv2ya16_X_c_template` function can be exploited by a remote attacker providing specially crafted input, leading to a denial of service. This impacts components like `ffmpeg`, `qt5-qtwebengine`, and `qt6-qtwebengine` in Red Hat Community Projects and Red Hat Enterprise Linux AI.

Remediation:
To mitigate this issue, users should avoid processing untrusted or specially crafted media files with applications that utilize FFmpeg. Limiting the exposure of applications using FFmpeg to untrusted input can reduce the risk of a denial of service.
drm/amd/pm: fix null pointer access
CVE: CVE-2025-38705
Component: kernel
Severity: None
Release date: 2025-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/pm: fix null pointer access

Writing a string without delimiters (' ', '\n', '\0') to the under
gpu_od/fan_ctrl sysfs or pp_power_profile_mode for the CUSTOM profile
will result in a null pointer dereference.


Remediation:
Missing character filtering in Python
CVE: CVE-2025-11468
Component: cpython
CWE: CWE-140
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Release date: 2025-01-01T00:00:00+00:00

Missing character filtering has been discovered in Python. When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"
CVE: CVE-2025-68818
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A NULL pointer dereference flaw was found in the QLogic Fibre Channel HBA driver (qla2xxx) in the Linux kernel. During ISP error recovery, the abort path incorrectly assumes all command types are TYPE_SRB. When operating in SCSI target mode with TYPE_TGT_CMD commands, this results in calling a NULL function pointer, causing a kernel crash.

Statement: This vulnerability specifically affects systems using QLogic FC HBAs in SCSI target mode configurations. It manifests during ISP error recovery sequences triggered by firmware errors. Standard initiator-mode deployments are less likely to encounter this crash path.

Remediation: