huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING
CVE: CVE-2025-21816
Component: kernel
CWE: CWE-664
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING

hrtimers are migrated away from the dying CPU to any online target at
the CPUHP_AP_HRTIMERS_DYING stage in order not to delay bandwidth timers
handling tasks involved in the CPU hotplug forward progress.

However wakeups can still be performed by the outgoing CPU after
CPUHP_AP_HRTIMERS_DYING. Those can result again in bandwidth timers being
armed. Depending on several considerations (crystal ball power management
based election, earliest timer already enqueued, timer migration enabled or
not), the target may eventually be the current CPU even if offline. If that
happens, the timer is eventually ignored.

The most notable example is RCU which had to deal with each and every of
those wake-ups by deferring them to an online CPU, along with related
workarounds:

_ e787644caf76 (rcu: Defer RCU kthreads wakeup when CPU is dying)
_ 9139f93209d1 (rcu/nocb: Fix RT throttling hrtimer armed from offline CPU)
_ f7345ccc62a4 (rcu/nocb: Fix rcuog wake-up from offline softirq)

The problem isn't confined to RCU though as the stop machine kthread
(which runs CPUHP_AP_HRTIMERS_DYING) reports its completion at the end
of its work through cpu_stop_signal_done() and performs a wake up that
eventually arms the deadline server timer:

   WARNING: CPU: 94 PID: 588 at kernel/time/hrtimer.c:1086 hrtimer_start_range_ns+0x289/0x2d0
   CPU: 94 UID: 0 PID: 588 Comm: migration/94 Not tainted
   Stopper: multi_cpu_stop+0x0/0x120 <- stop_machine_cpuslocked+0x66/0xc0
   RIP: 0010:hrtimer_start_range_ns+0x289/0x2d0
   Call Trace:
   <TASK>
     start_dl_timer
     enqueue_dl_entity
     dl_server_start
     enqueue_task_fair
     enqueue_task
     ttwu_do_activate
     try_to_wake_up
     complete
     cpu_stopper_thread

Instead of providing yet another bandaid to work around the situation, fix
it in the hrtimers infrastructure instead: always migrate away a timer to
an online target whenever it is enqueued from an offline CPU.

This will also allow to revert all the above RCU disgraceful hacks.


Remediation:
Marshmallow: Denial of Service via crafted request to Schema.load function
CVE: CVE-2025-68480
Component: github.com/marshmallow-code/marshmallow
CWE: CWE-1050
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-22T21:20:15.958000+00:00

A flaw was found in Marshmallow. A remote attacker could exploit a vulnerability in the `Schema.load(data, many=True)` function by sending a moderately sized request. This could lead to a denial of service (DoS) due to the disproportionate consumption of CPU time, making the system unavailable to legitimate users.

Statement: This vulnerability is rated Moderate. Applications within Ansible Automation Platform 2.4 and 2.5 that utilize `python-marshmallow` or `python3.11-marshmallow` to process untrusted input with `Schema.load(data, many=True)` may experience a denial of service. This can lead to a disproportionate consumption of CPU resources, impacting system availability.

Remediation:
vim main.c memory corruption
CVE: CVE-2025-1215
Component: vim
CWE: CWE-119
Severity: Low
CVSS v3: 2.9/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-02-12T18:31:06.472000+00:00

A flaw was found in Vim. A local user may be able to trigger memory corruption by using the `--log` option with a non-existent path, which can lead to an application crash or other undefined behavior.

Statement: This vulnerability is rated Low for Red Hat products. A local attacker must explicitly use the `--log` option with a non-existent path in vim to trigger memory corruption, leading to an application crash or undefined behavior. This requires user interaction and is not exploitable remotely. Affected products include Red Hat Enterprise Linux, Fedora, and OpenShift Container Platform (via the rhcos component).

Remediation:
XZ has a heap-use-after-free bug in threaded .xz decoder
CVE: CVE-2025-31115
Component: xz
CWE: CWE-823
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-03T16:57:05.488000+00:00

A flaw was found in the XZ Utils library. In affected versions, the multithreaded .xz decoder in liblzma has a bug where invalid input can trigger a heap use-after-free condition, allowing writes to an address based on the null pointer plus an offset. This issue may result in a crash or other undefined behavior. Applications and libraries that use the `lzma_stream_decoder_mt` function are affected.

Statement: This vulnerability is rated as important severity because a flaw exists in XZ Utils multithreaded .xz decoder within liblzma. When processing specially crafted compressed input, the decoder can trigger a heap use-after-free condition and perform memory writes to an address calculated from a null pointer plus an offset. These issues can reliably cause application crashes, leading to denial of service, and may allow memory corruption that affects process stability and security. Systems or applications decompressing untrusted .xz data with multithreaded decoding are at heightened risk of disruption and compromise.

Remediation:
null pointer dereference in ChemKinFormat::ReadReactionQualifierLines of the file /src/formats/chemkinformat.cpp
CVE: CVE-2025-10998
Component: openbabel
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-09-26T03:02:07.042000+00:00

A vulnerability has been found in Open Babel. The affected element is the function ChemKinFormat::ReadReactionQualifierLines of the file /src/formats/chemkinformat.cpp. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
JUnit can leak Git credentials
CVE: CVE-2025-53103
Component: org.junit.platform/junit-platform-reporting
CWE: CWE-312
Severity: Moderate
CVSS v3: 6.3/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Release date: 2025-07-01T18:02:39.060000+00:00

An information disclosure flaw was found in JUnit. When writing Open Test Reporting XML files, git credentials may be leaked. The full impact of this flaw depends on how these XML files are handled on a per-environment basis.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-14488
Component: RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability
Release date: 2025-12-19T14:28:42.467000+00:00

RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27657.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
mm: don't spin in add_stack_record when gfp flags don't allow
CVE: CVE-2025-68253
Component: kernel
CWE: CWE-835
Severity: Moderate
CVSS v3: 4.5/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-12-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm: don't spin in add_stack_record when gfp flags don't allow

syzbot was able to find the following path:
  add_stack_record_to_list mm/page_owner.c:182 [inline]
  inc_stack_record_count mm/page_owner.c:214 [inline]
  __set_page_owner+0x2c3/0x4a0 mm/page_owner.c:333
  set_page_owner include/linux/page_owner.h:32 [inline]
  post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851
  prep_new_page mm/page_alloc.c:1859 [inline]
  get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858
  alloc_pages_nolock_noprof+0x94/0x120 mm/page_alloc.c:7554

Don't spin in add_stack_record_to_list() when it is called
from *_nolock() context.

Statement: This affects systems with CONFIG_PAGE_OWNER enabled, which is primarily a kernel debugging feature not typically enabled in production kernels.

Remediation:
shmem: fix recovery on rename failures
CVE: CVE-2025-71072
Component: kernel
CWE: CWE-390
Severity: Low
CVSS v3: 2.6/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's shmem (tmpfs) filesystem rename operation. Under severe memory pressure, the maple_tree insertion used during file rename can fail, and the error recovery path does not properly handle this failure. This can leave the filesystem directory offset tree in an inconsistent state.

Statement: Triggering this vulnerability requires extreme memory exhaustion conditions during tmpfs rename operations. Normal system operation with adequate memory is unaffected. The filesystem inconsistency could cause subsequent directory operations to fail unexpectedly.

Remediation:
Libcontainer is affected by capabilities elevation
CVE: CVE-2025-27612
Component: libcontainer
CWE: CWE-276
Severity: Moderate
CVSS v3: 5.9/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-03-21T14:24:28.756000+00:00

A flaw was found in libcontainer. This vulnerability may allow elevation of capabilities via improper inheritance of capabilities in the tenant container when using the tenant builder.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-15333
Component: Tanium addressed an information disclosure vulnerability in Threat Response.
Release date: 2025-08-19T00:00:00+00:00

Tanium addressed an information disclosure vulnerability in Threat Response.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ksmbd: fix session use-after-free in multichannel connection
CVE: CVE-2025-22040
Component: kernel
CWE: CWE-416
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix session use-after-free in multichannel connection

There is a race condition between session setup and
ksmbd_sessions_deregister. The session can be freed before the connection
is added to channel list of session.
This patch check reference count of session before freeing it.


Remediation:
MD5 Hash Collision in llama_index
CVE: CVE-2025-3044
Component: llama-index
CWE: CWE-440
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2025-07-07T09:54:22.506000+00:00

A hash collision flaw was found in llama_index. The MD5 function is used in the ArxivReader class, and given the weakness in the MD5 hashing algorithm, an attacker can build colliding inputs.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
rcu: Protect ->defer_qs_iw_pending from data race
CVE: CVE-2025-39749
Component: kernel
Severity: None
Release date: 2025-09-11T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

rcu: Protect ->defer_qs_iw_pending from data race

On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is
invoked within an interrupts-disabled region of code [1], it will invoke
rcu_read_unlock_special(), which uses an irq-work handler to force the
system to notice when the RCU read-side critical section actually ends.
That end won't happen until interrupts are enabled at the soonest.

In some kernels, such as those booted with rcutree.use_softirq=y, the
irq-work handler is used unconditionally.

The per-CPU rcu_data structure's ->defer_qs_iw_pending field is
updated by the irq-work handler and is both read and updated by
rcu_read_unlock_special().  This resulted in the following KCSAN splat:

------------------------------------------------------------------------

BUG: KCSAN: data-race in rcu_preempt_deferred_qs_handler / rcu_read_unlock_special

read to 0xffff96b95f42d8d8 of 1 bytes by task 90 on cpu 8:
 rcu_read_unlock_special+0x175/0x260
 __rcu_read_unlock+0x92/0xa0
 rt_spin_unlock+0x9b/0xc0
 __local_bh_enable+0x10d/0x170
 __local_bh_enable_ip+0xfb/0x150
 rcu_do_batch+0x595/0xc40
 rcu_cpu_kthread+0x4e9/0x830
 smpboot_thread_fn+0x24d/0x3b0
 kthread+0x3bd/0x410
 ret_from_fork+0x35/0x40
 ret_from_fork_asm+0x1a/0x30

write to 0xffff96b95f42d8d8 of 1 bytes by task 88 on cpu 8:
 rcu_preempt_deferred_qs_handler+0x1e/0x30
 irq_work_single+0xaf/0x160
 run_irq_workd+0x91/0xc0
 smpboot_thread_fn+0x24d/0x3b0
 kthread+0x3bd/0x410
 ret_from_fork+0x35/0x40
 ret_from_fork_asm+0x1a/0x30

no locks held by irq_work/8/88.
irq event stamp: 200272
hardirqs last  enabled at (200272): [<ffffffffb0f56121>] finish_task_switch+0x131/0x320
hardirqs last disabled at (200271): [<ffffffffb25c7859>] __schedule+0x129/0xd70
softirqs last  enabled at (0): [<ffffffffb0ee093f>] copy_process+0x4df/0x1cc0
softirqs last disabled at (0): [<0000000000000000>] 0x0

------------------------------------------------------------------------

The problem is that irq-work handlers run with interrupts enabled, which
means that rcu_preempt_deferred_qs_handler() could be interrupted,
and that interrupt handler might contain an RCU read-side critical
section, which might invoke rcu_read_unlock_special().  In the strict
KCSAN mode of operation used by RCU, this constitutes a data race on
the ->defer_qs_iw_pending field.

This commit therefore disables interrupts across the portion of the
rcu_preempt_deferred_qs_handler() that updates the ->defer_qs_iw_pending
field.  This suffices because this handler is not a fast path.


Remediation:
octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
CVE: CVE-2025-71137
Component: kernel
CWE: CWE-190
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"

This patch ensures that the RX ring size (rx_pending) is not
set below the permitted length. This avoids UBSAN
shift-out-of-bounds errors when users passes small or zero
ring sizes via ethtool -G.

Statement: This issue is caused by missing validation of the RX ring size supplied via ethtool, allowing too small values to reach shift operations and trigger shift-out-of-bounds conditions.
The impact is limited to local privileged users and results in kernel warnings or potential crashes, making it a stability and robustness issue. No memory corruption or privilege escalation is possible.

Remediation:
@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
CVE: CVE-2025-25290
Component: octokit/request
CWE: CWE-1333
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-02-14T19:37:47.110000+00:00

A flaw was found in the octokit/request package for Node.js. The regular expression `/<([^>]+)>; rel="deprecation"/` used to match the link header in HTTP responses is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. This vulnerability arises due to the unbounded nature of the regex's matching behavior, which can lead to catastrophic backtracking when processing specially crafted input. This flaw allows an attacker to send a malicious link header, resulting in excessive CPU usage and potentially causing the server to become unresponsive, impacting service availability.


Remediation:
CVE: CVE-2025-14934
Component: NSF Unidata NetCDF-C Variable Name Stack-based Buffer Overflow Remote Code Execution Vulnerability
Release date: 2025-12-18T21:20:47.686000+00:00

NSF Unidata NetCDF-C Variable Name Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of variable names. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27267.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
scsi: ufs: core: Fix invalid probe error return value
CVE: CVE-2025-68316
Component: kernel
Severity: None
Release date: 2025-12-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: core: Fix invalid probe error return value

After DME Link Startup, the error return value is set to the MIPI UniPro
GenericErrorCode which can be 0 (SUCCESS) or 1 (FAILURE).  Upon failure
during driver probe, the error code 1 is propagated back to the driver
probe function which must return a negative value to indicate an error,
but 1 is not negative, so the probe is considered to be successful even
though it failed.  Subsequently, removing the driver results in an oops
because it is not in a valid state.

This happens because none of the callers of ufshcd_init() expect a
non-negative error code.

Fix the return value and documentation to match actual usage.


Remediation:
Unexpected paths returned from LookPath in os/exec
CVE: CVE-2025-47906
Component: os/exec
CWE: CWE-440
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2025-09-18T18:41:11.847000+00:00

A path handling flaw has been discovered in the os/exec go package. If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.


Remediation:
For more information visit https://access.redhat.com/errata/RHSA-2026:3461
For more information visit https://access.redhat.com/errata/RHSA-2026:3462
For more information visit https://access.redhat.com/errata/RHSA-2025:23449
For more information visit https://access.redhat.com/errata/RHSA-2025:23205
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
tcpreplay Heap Overflow Vulnerability
CVE: CVE-2025-9019
Component: tcpreplay
CVSS v3: 3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-08-15T07:02:10.548000+00:00

A flaw was found in tcpreplay. The `mask_cidr6` function in `cidr.c` contains a heap-based buffer overflow triggered by manipulation of network packets. A remote attacker can initiate the overflow by providing a specially crafted packet. This buffer overflow can lead to an application level denial of service.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
spi: tegra210-quad: Fix timeout handling
CVE: CVE-2025-68746
Component: kernel
CWE: CWE-825
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

spi: tegra210-quad: Fix timeout handling

When the CPU that the QSPI interrupt handler runs on (typically CPU 0)
is excessively busy, it can lead to rare cases of the IRQ thread not
running before the transfer timeout is reached.

While handling the timeouts, any pending transfers are cleaned up and
the message that they correspond to is marked as failed, which leaves
the curr_xfer field pointing at stale memory.

To avoid this, clear curr_xfer to NULL upon timeout and check for this
condition when the IRQ thread is finally run.

While at it, also make sure to clear interrupts on failure so that new
interrupts can be run.

A better, more involved, fix would move the interrupt clearing into a
hard IRQ handler. Ideally we would also want to signal that the IRQ
thread no longer needs to be run after the timeout is hit to avoid the
extra check for a valid transfer.


Remediation:
FontForge: Remote Code Execution via SFD File Parsing Deserialization of Untrusted Data
CVE: CVE-2025-15276
Component: fontforge
CWE: CWE-502
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-31T06:59:24.595000+00:00

A flaw was found in FontForge. A remote attacker could exploit this vulnerability by enticing a user to open a specially crafted SFD file. This issue arises from improper validation of user-supplied data during SFD file parsing, leading to deserialization of untrusted data. Successful exploitation could result in arbitrary code execution in the context of the current process.

Statement: This vulnerability is rated Important for Red Hat products as it allows for arbitrary code execution in FontForge. Exploitation requires user interaction, where a target must open a specially crafted SFD file. FontForge is shipped in Red Hat Enterprise Linux 6, 7, 8, 9, 10, Fedora, and Red Hat In-Vehicle OS.

Remediation:
To mitigate this issue, users should avoid opening SFD files from untrusted sources. If FontForge is not essential for system operation, consider removing the `fontforge` package to eliminate the attack vector. This action may impact functionality dependent on FontForge.