huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
PCI: Fix reference leak in pci_register_host_bridge()
CVE: CVE-2025-37836
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

PCI: Fix reference leak in pci_register_host_bridge()

If device_register() fails, call put_device() to give up the reference to
avoid a memory leak, per the comment at device_register().

Found by code review.

[bhelgaas: squash Dan Carpenter's double free fix from
https://lore.kernel.org/r/db806a6c-a91b-4e5a-a84b-6b7e01bdac85@stanley.mountain]


Remediation:
nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()
CVE: CVE-2025-21848
Component: kernel
CWE: CWE-395
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-03-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()

Add check for the return value of nfp_app_ctrl_msg_alloc() in
nfp_bpf_cmsg_alloc() to prevent null pointer dereference.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Spring Framework Annotation Detection Vulnerability
CVE: CVE-2025-41249
Component: org.springframework/spring-core
CWE: CWE-863
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-09-16T10:15:34.118000+00:00

The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
libheif has Potential Heap Buffer Over-Read
CVE: CVE-2025-68431
Component: libheif
CVSS v3: 7.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-12-29T19:09:54.628000+00:00

libheif is an HEIF and AVIF file format decoder and encoder. Prior to version 1.21.0, a crafted HEIF that exercises the overlay image item path triggers a heap buffer over-read in `HeifPixelImage::overlay()`. The function computes a negative row length (likely from an unclipped overlay rectangle or invalid offsets), which then underflows when converted to `size_t` and is passed to `memcpy`, causing a very large read past the end of the source plane and a crash. Version 1.21.0 contains a patch. As a workaround, avoid decoding images using `iovl` overlay boxes.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation
CVE: CVE-2025-37973
Component: kernel
Severity: Moderate
CVSS v3: 6.4/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation

Currently during the multi-link element defragmentation process, the
multi-link element length added to the total IEs length when calculating
the length of remaining IEs after the multi-link element in
cfg80211_defrag_mle(). This could lead to out-of-bounds access if the
multi-link element or its corresponding fragment elements are the last
elements in the IEs buffer.

To address this issue, correctly calculate the remaining IEs length by
deducting the multi-link element end offset from total IEs end offset.

Statement: A flaw was found in the Linux kernel's cfg80211_defrag_mle() function, where an incorrect calculation of the remaining IEs length could lead to an out-of-bounds memory access during multi-link element (MLE) defragmentation. A malicious beacon or probe response frame containing fragmented MLEs could potentially trigger this issue.
This flaw is exploitable in setups where userspace or firmware passes raw Wi-Fi frames to the kernel for parsing (e.g., via softmac drivers), but requires attacker-controlled wireless traffic and a vulnerable parsing path.

Remediation:
Apache Tomcat denial of service
CVE: CVE-2025-52520
Component: tomcat
CWE: CWE-190
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-07-10T19:05:41.637000+00:00

A denial of service flaw was found in Apache Tomcat. For some unlikely configurations of multipart upload, an integer overflow vulnerability may lead to a denial of service via bypassing size limits.


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.

The References section of this erratum contains a download link for the update. You must be logged in to download the update.
Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.

The References section of this erratum contains a download link for the update. You must be logged in to download the update.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-8640
Component: Kenwood DMX958XR Firmware Update Command Injection Vulnerability
Release date: 2025-08-06T01:13:42.197000+00:00

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26263.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
CVE: CVE-2025-38540
Component: kernel
CWE: CWE-440
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras

The Chicony Electronics HP 5MP Cameras (USB ID 04F2:B824 & 04F2:B82C)
report a HID sensor interface that is not actually implemented.
Attempting to access this non-functional sensor via iio_info causes
system hangs as runtime PM tries to wake up an unresponsive sensor.

Add these 2 devices to the HID ignore list since the sensor interface is
non-functional by design and should not be exposed to userspace.


Remediation:
mm/secretmem: fix use-after-free race in fault handler
CVE: CVE-2025-40272
Component: kernel
CWE: CWE-1341
Severity: Moderate
CVSS v3: 5.9/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Release date: 2025-12-06T00:00:00+00:00

A use-after-free race condition was found in the secretmem subsystem of the Linux kernel. When two tasks concurrently fault on the same page in a memfd_secret file, the losing task may free its folio before restoring the direct map entry. This allows the freed page to be reallocated while still unmapped, causing potential memory corruption.

Statement: Exploitation requires use of the memfd_secret() syscall with concurrent page faults. This feature is used for storing sensitive data like cryptographic keys. The race window is narrow but could be widened by an attacker.

Remediation:
openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
CVE: CVE-2025-21761
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: use RCU protection in ovs_vport_cmd_fill_info()

ovs_vport_cmd_fill_info() can be called without RTNL or RCU.

Use RCU protection and dev_net_rcu() to avoid potential UAF.

Statement: The bug could happen only if vSwitch (that is a multilayer Ethernet switch) being used. The security impact is limited, because no known way how unprivileged user can trigger it.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent module openvswitch from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Inconsistent comparator in XSLT sorting led to out-of-bounds access
CVE: CVE-2025-1932
Component: firefox
CWE: CWE-125
Severity: Important
CVSS v3: 8.3/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H
Release date: 2025-03-04T13:31:23.551000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: An inconsistent comparator in xslt/txNodeSorter could have resulted in potentially exploitable out-of-bounds access.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
smbd doesn't pick up group membership changes when re-authenticating an expired SMB session
CVE: CVE-2025-0620
Component: samba
CWE: CWE-552
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.


Remediation:
net/mdiobus: Fix potential out-of-bounds clause 45 read/write access
CVE: CVE-2025-38110
Component: kernel
CWE: CWE-1284
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Release date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/mdiobus: Fix potential out-of-bounds clause 45 read/write access

When using publicly available tools like 'mdio-tools' to read/write data
from/to network interface and its PHY via C45 (clause 45) mdiobus,
there is no verification of parameters passed to the ioctl and
it accepts any mdio address.
Currently there is support for 32 addresses in kernel via PHY_MAX_ADDR define,
but it is possible to pass higher value than that via ioctl.
While read/write operation should generally fail in this case,
mdiobus provides stats array, where wrong address may allow out-of-bounds
read/write.

Fix that by adding address verification before C45 read/write operation.
While this excludes this access from any statistics, it improves security of
read/write operation.

Statement: A bounds check was missing in the __mdiobus_c45_read() and __mdiobus_c45_write() functions, allowing out-of-bounds access to the stats array in the kernel if a user supplied an invalid PHY address via an ioctl. Although the read/write would typically fail on hardware, the statistics array was still accessed, potentially leading to an out-of-bounds memory read/write in kernel space. This patch adds a check that ensures the PHY address does not exceed PHY_MAX_ADDR, mitigating the risk. The Privileges required for the CVSS is High (PR: H), because requires administrative privileges to issue raw ioctl commands to a network interface (typically CAP_NET_ADMIN). Potential memory corruption could happen inside the firmware of the networking hardware, but not for the memory of the Linux Kernel, and this is the reason why no Kernel Crash could be (and A:N for CVSS).

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent module mdio from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Vuetify XSS through 'eventMoreText' prop of VCalendar
CVE: CVE-2025-1461
Component: vuetify
CVSS v3: 5.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-05-28T17:26:51.320000+00:00

A flaw was found in Vuetify. Improper neutralization of the value of the 'eventMoreText' property of the 'VCalendar' component allows unsanitized HTML to be inserted into the page. This can lead to a Cross-Site Scripting (XSS) attack. This issue occurs because the default Vuetify translator will return the translation key as the translation, if it can't find an actual translation.

This issue affects Vuetify versions greater than or equal to 2.0.0 and less than 3.0.0.

Note: Version 2.x of Vuetify is End-of-Life and will not receive any updates to address this issue. For more information see  here https://v2.vuetifyjs.com/en/about/eol/ .

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ACPI: pfr_update: Fix the driver update version check
CVE: CVE-2025-39701
Component: kernel
CWE: CWE-1025
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-09-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ACPI: pfr_update: Fix the driver update version check

The security-version-number check should be used rather
than the runtime version check for driver updates.

Otherwise, the firmware update would fail when the update binary had
a lower runtime version number than the current one.

[ rjw: Changelog edits ]


Remediation:
regulator: check that dummy regulator has been probed before using it
CVE: CVE-2025-22008
Component: kernel
CWE: CWE-29
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

regulator: check that dummy regulator has been probed before using it

Due to asynchronous driver probing there is a chance that the dummy
regulator hasn't already been probed when first accessing it.


Remediation:
dmaengine: bcm-sba-raid: fix device leak on probe
CVE: CVE-2025-71190
Component: kernel
Severity: None
Release date: 2025-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: bcm-sba-raid: fix device leak on probe

Make sure to drop the reference taken when looking up the mailbox device
during probe on probe failures and on driver unbind.


Remediation:
vtk: Kitware VTK (Visualization Toolkit) contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader
CVE: CVE-2025-57108
Component: Kitware VTK
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-10-31T00:00:00+00:00

Kitware VTK (Visualization Toolkit) contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability manifests during mesh object copy operations where vector members are accessed after the underlying memory has been freed, specifically when handling GLTF files with corrupted or invalid mesh reference structures.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2025-5834
Component: Pioneer DMH-WT7600NEX Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability
Release date: 2025-06-11T17:29:49.034000+00:00

Pioneer DMH-WT7600NEX Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to bypass authentication on affected installations of Pioneer DMH-WT7600NEX devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the configuration of the application system-on-chip (SoC). The issue results from the lack of a properly configured hardware root of trust. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the boot process. Was ZDI-CAN-26078.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
thunderbird: Same-origin policy bypass in the Layout component
CVE: CVE-2025-10529
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-09-16T12:26:35.822000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Firebird Access Bypass
CVE: CVE-2025-24975
Component: firebirdsql
CVSS v3: 7.2/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Release date: 2025-08-15T15:11:29.986000+00:00

A flaw has been discovered in the Firebird SQL project that can lead to an access bypass. If connections stored in the ExtConnPool are not properly verified for the CryptCallback interface upon creation, it could cause a server process segmentation fault.

This vulnerability could allow an attachment to access an encrypted database without the required key if the database was previously accessed by an execute statement on external command. The segmentation fault, which could also affect unencrypted databases, can be triggered when a chain of execute statements is used.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net: stmmac: Correctly handle Rx checksum offload errors
CVE: CVE-2025-40337
Component: kernel
Severity: None
Release date: 2025-12-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: Correctly handle Rx checksum offload errors

The stmmac_rx function would previously set skb->ip_summed to
CHECKSUM_UNNECESSARY if hardware checksum offload (CoE) was enabled
and the packet was of a known IP ethertype.

However, this logic failed to check if the hardware had actually
reported a checksum error. The hardware status, indicating a header or
payload checksum failure, was being ignored at this stage. This could
cause corrupt packets to be passed up the network stack as valid.

This patch corrects the logic by checking the `csum_none` status flag,
which is set when the hardware reports a checksum error. If this flag
is set, skb->ip_summed is now correctly set to CHECKSUM_NONE,
ensuring the kernel's network stack will perform its own validation and
properly handle the corrupt packet.


Remediation:
NULL Pointer Dereference in Wireshark
CVE: CVE-2025-9817
Component: Wireshark
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-09-03T07:38:58.940000+00:00

A flaw was found in Wireshark’s SSH dissector, caused by a missing NULL check in key exchange parameter handling. This vulnerability can trigger a segmentation fault when processing malformed SSH traffic or crafted capture files, potentially causing the application to crash and resulting in a denial of service.

Statement: This issue is considered Moderate rather than an Important flaw because its impact is limited to application availability and does not allow arbitrary code execution or information disclosure. The vulnerability leads to a segmentation fault in the SSH dissector, which can crash Wireshark or TShark, but only when the user opens a malicious capture file or analyzes traffic containing malformed SSH packets. Since exploitation requires user interaction (opening the file) or the ability to inject traffic into a monitored network, and the consequence is restricted to denial of service rather than compromising confidentiality or integrity, the severity is classified as Moderate.

Remediation:
Users should avoid opening packet captures from untrusted sources and restrict analysis to known, reliable traffic. Running Wireshark with non-privileged accounts or in a sandboxed environment can also help minimize the impact of a crash.
nvmet: fix memory leak of bio integrity
CVE: CVE-2025-38405
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nvmet: fix memory leak of bio integrity

If nvmet receives commands with metadata there is a continuous memory
leak of kmalloc-128 slab or more precisely bio->bi_integrity.

Since commit bf4c89fc8797 ("block: don't call bio_uninit from bio_endio")
each user of bio_init has to use bio_uninit as well. Otherwise the bio
integrity is not getting free. Nvmet uses bio_init for inline bios.

Uninit the inline bio to complete deallocation of integrity in bio.


Remediation: