huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Xwayland: Use-after-free of the root cursor
CVE: CVE-2025-26594
Component: X.Org
CWE: CWE-416
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-02-25T00:00:00+00:00

A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.

Statement: Xorg server does not run with root privileges in Red Hat Enterprise Linux 8 and 9, therefore, Red Hat Enterprise Linux 8 and 9 have been rated with a Moderate severity and are not affected by this bug.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
iperf Buffer Overflow
CVE: CVE-2025-54351
Component: iperf3
CWE: CWE-420
Severity: Important
CVSS v3: 8.8/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Release date: 2025-08-03T00:00:00+00:00

A flaw was found in iperf3. The `recv` function in `net.c` exhibits a buffer overflow when the `--skip-rx-copy` option is used with `MSG_TRUNC`, allowing a network attacker to trigger the overflow. This vulnerability allows an attacker to send a specially crafted message. The resulting buffer overflow may lead to an application-level denial of service.

Statement: This vulnerability was introduced with option --skip-rx-copy which was added after version 3.17.1. We currently have an older version of code in Red Hat Enterprise Linux(RHEL). No Red Hat products or offerings are affected by this vulnerability.

This vulnerability marked as Important instead a Moderate flaw due to the nature of the bug and the execution context. The flaw lies in the mishandling of buffer boundaries when the MSG_TRUNC flag is used in conjunction with the --skip-rx-copy option, leading to a classical buffer overflow. Unlike typical logic or input validation bugs that may merely crash an application, buffer overflows directly corrupt memory, potentially allowing arbitrary code execution depending on memory layout and platform-specific mitigations. Since iperf3 is often used in automated performance testing setups, CI pipelines, or even embedded environments, attackers could exploit this vulnerability remotely by sending crafted UDP packets, leading to memory corruption without any authentication. The use of MSG_TRUNC and skipped copy operations already places the application in a performance-optimized but less safe path, and the lack of proper bounds checking under these conditions makes it a memory safety issue—a class of bugs known to be exploitable and impactful

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
CVE: CVE-2025-7251
Component: IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Release date: 2025-07-08T19:50:34.668000+00:00

IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26108.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create()
CVE: CVE-2025-37852
Component: kernel
Severity: None
Release date: 2025-05-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create()

Add error handling to propagate amdgpu_cgs_create_device() failures
to the caller. When amdgpu_cgs_create_device() fails, release hwmgr
and return -ENOMEM to prevent null pointer dereference.

[v1]->[v2]: Change error code from -EINVAL to -ENOMEM. Free hwmgr.


Remediation:
net: switchdev: Convert blocking notification chain to a raw one
CVE: CVE-2025-21986
Component: kernel
CWE: CWE-833
Severity: Low
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: switchdev: Convert blocking notification chain to a raw one

A blocking notification chain uses a read-write semaphore to protect the
integrity of the chain. The semaphore is acquired for writing when
adding / removing notifiers to / from the chain and acquired for reading
when traversing the chain and informing notifiers about an event.

In case of the blocking switchdev notification chain, recursive
notifications are possible which leads to the semaphore being acquired
twice for reading and to lockdep warnings being generated [1].

Specifically, this can happen when the bridge driver processes a
SWITCHDEV_BRPORT_UNOFFLOADED event which causes it to emit notifications
about deferred events when calling switchdev_deferred_process().

Fix this by converting the notification chain to a raw notification
chain in a similar fashion to the netdev notification chain. Protect
the chain using the RTNL mutex by acquiring it when modifying the chain.
Events are always informed under the RTNL mutex, but add an assertion in
call_switchdev_blocking_notifiers() to make sure this is not violated in
the future.

Maintain the "blocking" prefix as events are always emitted from process
context and listeners are allowed to block.

[1]:
WARNING: possible recursive locking detected
6.14.0-rc4-custom-g079270089484 #1 Not tainted
--------------------------------------------
ip/52731 is trying to acquire lock:
ffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0

but task is already holding lock:
ffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0

other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock((switchdev_blocking_notif_chain).rwsem);
lock((switchdev_blocking_notif_chain).rwsem);

*** DEADLOCK ***
May be due to missing lock nesting notation
3 locks held by ip/52731:
 #0: ffffffff84f795b0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x727/0x1dc0
 #1: ffffffff8731f628 (&net->rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x790/0x1dc0
 #2: ffffffff850918d8 ((switchdev_blocking_notif_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x58/0xa0

stack backtrace:
...
? __pfx_down_read+0x10/0x10
? __pfx_mark_lock+0x10/0x10
? __pfx_switchdev_port_attr_set_deferred+0x10/0x10
blocking_notifier_call_chain+0x58/0xa0
switchdev_port_attr_notify.constprop.0+0xb3/0x1b0
? __pfx_switchdev_port_attr_notify.constprop.0+0x10/0x10
? mark_held_locks+0x94/0xe0
? switchdev_deferred_process+0x11a/0x340
switchdev_port_attr_set_deferred+0x27/0xd0
switchdev_deferred_process+0x164/0x340
br_switchdev_port_unoffload+0xc8/0x100 [bridge]
br_switchdev_blocking_event+0x29f/0x580 [bridge]
notifier_call_chain+0xa2/0x440
blocking_notifier_call_chain+0x6e/0xa0
switchdev_bridge_port_unoffload+0xde/0x1a0
...


Remediation:
Redis Stack Buffer Overflow
CVE: CVE-2025-27151
Component: redis
CWE: CWE-20
Severity: Moderate
CVSS v3: 2.6/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-05-29T09:07:34.779000+00:00

A flaw was found in Redis. Using memcpy with the strlen filepath when copying a user-supplied file path into a fixed-size stack buffer in redis-check-aof results in a stack-based buffer overflow. This flaw allows a local attacker to trigger the overflow by providing a specially crafted file path, allowing potential code execution. The primary consequence is a possible denial of service.

Statement: The availability impact is limited to the instance of Redis and not to the system as a whole.

Remediation:
Skops: Joblib Model Loading Code Execution
CVE: CVE-2025-54886
Component: skops
CVSS v3: 6.9/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Release date: 2025-08-08T00:03:45.318000+00:00

A flaw was found in skops. The Card.get_model function allows arbitrary code execution due to a lack of input validation, allowing a local attacker to trigger this vulnerability. This issue occurs when processing a malicious job file, leading to potential arbitrary code execution on the affected system.

Statement: The severity of this vulnerability is rated Moderate, as it does not impact system availability. The effects are confined to the application layer, without compromising the underlying system stability.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Authenticated remote code execution risk in the Moodle LMS EQUELLA repository
CVE: CVE-2025-3642
Component: moodle
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-04-22T12:00:00+00:00

A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only available to teachers and managers on sites with the EQUELLA repository enabled.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll
CVE: CVE-2025-37917
Component: kernel
Severity: None
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll

Use spin_lock_irqsave and spin_unlock_irqrestore instead of spin_lock
and spin_unlock in mtk_star_emac driver to avoid spinlock recursion
occurrence that can happen when enabling the DMA interrupts again in
rx/tx poll.

```
BUG: spinlock recursion on CPU#0, swapper/0/0
 lock: 0xffff00000db9cf20, .magic: dead4ead, .owner: swapper/0/0,
    .owner_cpu: 0
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted
    6.15.0-rc2-next-20250417-00001-gf6a27738686c-dirty #28 PREEMPT
Hardware name: MediaTek MT8365 Open Platform EVK (DT)
Call trace:
 show_stack+0x18/0x24 (C)
 dump_stack_lvl+0x60/0x80
 dump_stack+0x18/0x24
 spin_dump+0x78/0x88
 do_raw_spin_lock+0x11c/0x120
 _raw_spin_lock+0x20/0x2c
 mtk_star_handle_irq+0xc0/0x22c [mtk_star_emac]
 __handle_irq_event_percpu+0x48/0x140
 handle_irq_event+0x4c/0xb0
 handle_fasteoi_irq+0xa0/0x1bc
 handle_irq_desc+0x34/0x58
 generic_handle_domain_irq+0x1c/0x28
 gic_handle_irq+0x4c/0x120
 do_interrupt_handler+0x50/0x84
 el1_interrupt+0x34/0x68
 el1h_64_irq_handler+0x18/0x24
 el1h_64_irq+0x6c/0x70
 regmap_mmio_read32le+0xc/0x20 (P)
 _regmap_bus_reg_read+0x6c/0xac
 _regmap_read+0x60/0xdc
 regmap_read+0x4c/0x80
 mtk_star_rx_poll+0x2f4/0x39c [mtk_star_emac]
 __napi_poll+0x38/0x188
 net_rx_action+0x164/0x2c0
 handle_softirqs+0x100/0x244
 __do_softirq+0x14/0x20
 ____do_softirq+0x10/0x20
 call_on_irq_stack+0x24/0x64
 do_softirq_own_stack+0x1c/0x40
 __irq_exit_rcu+0xd4/0x10c
 irq_exit_rcu+0x10/0x1c
 el1_interrupt+0x38/0x68
 el1h_64_irq_handler+0x18/0x24
 el1h_64_irq+0x6c/0x70
 cpuidle_enter_state+0xac/0x320 (P)
 cpuidle_enter+0x38/0x50
 do_idle+0x1e4/0x260
 cpu_startup_entry+0x34/0x3c
 rest_init+0xdc/0xe0
 console_on_rootfs+0x0/0x6c
 __primary_switched+0x88/0x90
```


Remediation:
Incorrect removal of permissions on PCI device unplug
CVE: CVE-2025-58149
Component: xen
CVSS v3: 5.9/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Release date: 2025-10-31T11:50:39.536000+00:00

A flaw was found in Xen. When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have. As a result a domain can still have access to any 64bit memory BAR when such device is no longer assigned to the domain. A buggy or malicious PV guest can access memory of PCI devices no longer assigned to it.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
wifi: mac80211: ocb: skip rx_no_sta when interface is not joined
CVE: CVE-2025-71224
Component: kernel
CWE: CWE-166
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: ocb: skip rx_no_sta when interface is not joined

ieee80211_ocb_rx_no_sta() assumes a valid channel context, which is only
present after JOIN_OCB.

RX may run before JOIN_OCB is executed, in which case the OCB interface
is not operational. Skip RX peer handling when the interface is not
joined to avoid warnings in the RX path.


Remediation:
Optimizer unspecified vulnerability (CPU Jul 2025)
CVE: CVE-2025-50083
Component: mysql
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-15T19:27:42.497000+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).


Remediation:
c-ares: Denial of Service due to query termination after maximum attempts
CVE: CVE-2025-62408
Component: c-ares
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-08T22:04:08.565000+00:00

A flaw was found in c-ares. This vulnerability allows a Denial of Service (DoS) via terminating a query after maximum attempts when using `read_answer()` and `process_answer()` functions.

Statement: This vulnerability is rated Moderate for Red Hat products. The flaw in c-ares can lead to a Denial of Service when the library is used to resolve queries, specifically when `read_answer()` and `process_answer()` functions are called and a query terminates after maximum attempts. This could impact applications that rely on c-ares for asynchronous DNS resolution.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
vLLM uses Python 3.12 built-in hash() which leads to predictable hash collisions in prefix cache
CVE: CVE-2025-25183
Component: vllm
CWE: CWE-916
Severity: Low
CVSS v3: 2.7/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Release date: 2025-02-06T20:00:05+00:00

A flaw was found in the vllm package. Maliciously constructed statements can lead to hash collisions, resulting in cache reuse, which can interfere with subsequent responses and cause unintended behavior. The impact of a collision would be using a cache that was generated using different content. With the knowledge of the prompts in use and predictable hashing behavior, someone could intentionally populate the cache using a prompt known to collide with another prompt in use.


Remediation:
Using a hashing algorithm that is less prone to collision, such as sha256, for example, would be the best way to avoid the possibility of a collision.
mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters()
CVE: CVE-2025-39909
Component: kernel
Severity: None
Release date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters()

Patch series "mm/damon: avoid divide-by-zero in DAMON module's parameters
application".

DAMON's RECLAIM and LRU_SORT modules perform no validation on
user-configured parameters during application, which may lead to
division-by-zero errors.

Avoid the divide-by-zero by adding validation checks when DAMON modules
attempt to apply the parameters.


This patch (of 2):

During the calculation of 'hot_thres' and 'cold_thres', either
'sample_interval' or 'aggr_interval' is used as the divisor, which may
lead to division-by-zero errors.  Fix it by directly returning -EINVAL
when such a case occurs.  Additionally, since 'aggr_interval' is already
required to be set no smaller than 'sample_interval' in damon_set_attrs(),
only the case where 'sample_interval' is zero needs to be checked.


Remediation:
CVE: CVE-2025-7314
Component: IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability
Release date: 2025-07-08T20:00:39.185000+00:00

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26400.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
sunrpc: fix null pointer dereference on zero-length checksum
CVE: CVE-2025-40129
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-11-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: fix null pointer dereference on zero-length checksum

In xdr_stream_decode_opaque_auth(), zero-length checksum.len causes
checksum.data to be set to NULL. This triggers a NPD when accessing
checksum.data in gss_krb5_verify_mic_v2(). This patch ensures that
the value of checksum.len is not less than XDR_UNIT.


Remediation:
net/sched: sch_qfq: Fix null-deref in agg_dequeue
CVE: CVE-2025-40083
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_qfq: Fix null-deref in agg_dequeue

To prevent a potential crash in agg_dequeue (net/sched/sch_qfq.c)
when cl->qdisc->ops->peek(cl->qdisc) returns NULL, we check the return
value before using it, similar to the existing approach in sch_hfsc.c.

To avoid code duplication, the following changes are made:

1. Changed qdisc_warn_nonwc(include/net/pkt_sched.h) into a static
inline function.

2. Moved qdisc_peek_len from net/sched/sch_hfsc.c to
include/net/pkt_sched.h so that sch_qfq can reuse it.

3. Applied qdisc_peek_len in agg_dequeue to avoid crashing.


Remediation:
Double-free in libvpx encoder
CVE: CVE-2025-5283
Component: libvpx
CWE: CWE-415
Severity: Important
CVSS v3: 8.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Release date: 2025-05-27T18:56:00+00:00

A flaw was found in libvpx. A double-free issue can occur in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC. This can cause memory corruption and an exploitable crash.

Statement: This vulnerability marked as Important rather than Moderate due to the nature of the flaw, a double-free in vpx_codec_enc_init_multi, which can lead to heap memory corruption. Double-free issues compromise memory integrity and are often a precursor to use-after-free or arbitrary code execution vulnerabilities, particularly in applications written in C/C++ that lack memory safety guarantees. In this case, the vulnerability occurs during encoder initialization for WebRTC, a high-frequency, remotely triggerable code path in browsers like Firefox. Because the failure happens after a failed allocation, it exposes a non-trivial edge case in error handling, which can be difficult to audit and reliably mitigate. The risk is elevated by the fact that WebRTC handles untrusted input from remote peers, making the flaw remotely exploitable in real-world scenarios.

Remediation:
Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.
HDF5 Use-After-Free Vulnerability
CVE: CVE-2025-6856
Component: hdf5
CWE: CWE-416
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-06-29T09:31:05.927000+00:00

A flaw was found in hdf5. The H5FL__reg_gc_list function in src/H5FL.c contains a use-after-free condition, requiring local attacker interaction. Manipulation of the file triggers this condition, potentially leading to a denial of service. This vulnerability stems from improper memory management during garbage collection list registration.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Dokuwiki cross site scripting
CVE: CVE-2025-61224
Component: dokuwiki
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-10-06T00:00:00+00:00

Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitrary code via the q parameter

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
thunderbird: JIT miscompilation in the JavaScript Engine: JIT component
CVE: CVE-2025-14324
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-09T13:37:57.533000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine: JIT component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation: