huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-46189: kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path
Component: kernel
Severity: Important
CWE: CWE-1341 (Multiple Releases of Same Resource or Handle)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-28T00:00:00+00:00

A flaw was found in the Linux kernel, specifically within the RDMA (Remote Direct Memory Access) vmw_pvrdma module. This vulnerability is a double free, which means the system attempts to release the same memory resource twice. This can occur in an error handling path within the `pvrdma_alloc_ucontext()` function. Exploiting this flaw could lead to memory corruption or cause the system to become unavailable, resulting in a denial of service (DoS).


Affected upstream versions: 4.10
Fixed upstream versions: 0, 5.10.258, 5.15.209, 6.1.175, 6.12.88, 6.18.30, 6.6.140, 7.0.7, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 269967d7693304e1f06ed2dff4ebbbeeb397cda4
CVE-2026-46195: kernel: smb: client: validate dacloffset before building DACL pointers
Component: kernel
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.5 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-28T00:00:00+00:00

A flaw was found in the Linux kernel's Server Message Block (SMB) client. A malicious server can exploit this vulnerability on 32-bit systems by providing a crafted dacloffset value. This can cause a pointer wrap, leading to the dereferencing of invalid Discretionary Access Control List (DACL) fields during chmod or chown operations. This memory corruption could potentially allow the malicious server to bypass security mechanisms or cause a denial of service.

Statement: This is an Important flaw in the Linux kernel's Server Message Block (SMB) client, affecting 32-bit Red Hat Enterprise Linux systems. A malicious SMB server could exploit a pointer wrap vulnerability during chmod or chown operations, potentially leading to memory corruption, a denial of service, or security mechanism bypass. Exploitation requires the affected 32-bit system to connect to a specially crafted malicious SMB server.

Affected upstream versions: 5.12
Fixed upstream versions: 0, 5.15.210, 6.1.176, 6.12.88, 6.18.30, 6.6.140, 7.0.7, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5de2665e913a10ad70aaeecf736b97276e83d995
CVE-2026-46209: kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-05-28T00:00:00+00:00

A flaw was found in the Linux kernel's Direct Rendering Manager (DRM) Graphics Execution Manager (GEM) component. This vulnerability arises from an inconsistent calculation of plane dimensions, which can lead to incorrect memory allocation checks. A local attacker could exploit this by creating a specially crafted Graphics Execution Manager (GEM) object that bypasses security validations. This could allow the GPU to access memory outside its designated area, potentially leading to memory corruption, information disclosure, or the execution of unauthorized code.

Statement: A Moderate flaw was found in the Linux kernel's Direct Rendering Manager (DRM) Graphics Execution Manager (GEM) component. This vulnerability allows a local attacker to craft a GEM object that bypasses memory allocation checks due to inconsistent plane dimension calculations. Successful exploitation could lead to memory corruption, information disclosure, or arbitrary code execution by enabling the GPU to access memory beyond allocated bounds.

Affected upstream versions: 4.14
Fixed upstream versions: 0, 5.10.258, 5.15.209, 6.1.175, 6.12.90, 6.18.32, 6.6.140, 7.0.9, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 11427ad6c9f0def5ce567982b785da3191946430
CVE-2026-46215: kernel: drm: Set old handle to NULL before prime swap in change_handle
Component: kernel
Severity: Important
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-28T00:00:00+00:00

A flaw was found in the Linux kernel. A race condition in the Direct Rendering Manager (DRM) subsystem's `change_handle` function could allow a local attacker to trigger a use-after-free vulnerability. This occurs when a concurrent `gem_close` operation removes one handle while another remains dangling. Successful exploitation of this flaw could lead to arbitrary code execution or privilege escalation.

Statement: This Important flaw in the Linux kernel's Direct Rendering Manager (DRM) subsystem could allow a local attacker to achieve arbitrary code execution or privilege escalation due to a race condition in the `change_handle` function. This vulnerability arises from a use-after-free scenario when handling graphics memory, specifically when a `gem_close` operation occurs concurrently with handle changes, leaving a dangling reference.

Affected upstream versions: 6.18
Fixed upstream versions: 0, 6.18.32, 7.0.9, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 672464dd53231509c9c771110798c56d4660e19e
CVE-2026-46227: kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
Component: kernel
Severity: Important
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-28T00:00:00+00:00

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A race condition exists in the `SCTP_SENDALL` path where a cached list entry is not properly revalidated after the socket lock is temporarily released. This allows a local attacker or a remote attacker (via a network abort) to trigger a use-after-free or type confusion vulnerability. Successful exploitation can lead to a controlled indirect call, potentially resulting in arbitrary code execution.

Statement: A stale list cursor in the SCTP_SENDALL path can be used after sctp_sendmsg_to_asoc() temporarily drops the socket lock while waiting for send buffer space. During this window another local thread can peel off or close the cached next association, or the association can be removed by a network ABORT, leaving the iterator to advance to a freed or migrated object. This creates a use after free or type confusion in the SCTP association list walk and may allow kernel memory corruption. For the CVSS the PR:L is used because triggering requires a local unprivileged process with access to SCTP socket operations, not administrator rights. The issue is not a pure remote network bug because local code execution is needed to drive SCTP_SENDALL and related socket operations, although network ABORT traffic can participate in one removal path.

Affected upstream versions: 4.17
Fixed upstream versions: 0, 5.10.258, 5.15.209, 6.1.175, 6.12.90, 6.18.32, 6.6.140, 7.0.9, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f3a3f0b406b4b7eb3cea35a23fa2bf170848b104
CVE-2026-46242: kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF
Component: kernel
Severity: Important
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-30T00:00:00+00:00

A flaw was found in the Linux kernel's `eventpoll` mechanism. A Use-After-Free (UAF) vulnerability, where the system attempts to access memory after it has been freed, can occur during the removal of a file. A local attacker could exploit this race condition to corrupt memory, potentially leading to privilege escalation or arbitrary code execution. This allows an attacker to gain elevated control over the system.

Statement: A race in eventpoll ep_remove() can let a concurrent file release observe a transient cleared file f_ep state and skip the normal eventpoll_release_file cleanup path. In the epoll watches epoll case this can free the watched struct eventpoll while ep_remove() still uses list pointers that refer into that freed object, so hlist_del_rcu() can write into freed kmalloc memory. This is a use-after-free memory corruption issue rather than a pure crash or resource leak. For the CVSS the AC:H is selected because reliable triggering depends on a race window between ep_remove() and __fput(). The issue is not network reachable. Impact is at least a local denial of service via kernel crash and in worst case may allow confidentiality, integrity, and availability compromise due to kernel heap memory corruption. Keeping Moderate with CVSS 7.0, but could be increased to the Important if reproducer becomes available that shows LPE possibility.

RHEL 9.0 and 9.2 are not affected.

Affected upstream versions: 6.1.175 < 6.1.178, 5.15.209 < 5.16, 6.4
Fixed upstream versions: 0, 5.16, 6.1.178, 6.12.95, 6.18.33, 6.6.144, 7.0.10, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3e1144d2515d28e4312e663ea05eac203101491d
CVE-2026-46243: kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions
Component: kernel
Severity: Important
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-26T00:00:00+00:00

A privilege escalation vulnerability was found in the Linux kernel's CIFS client implementation. This could allow a local attacker to impersonate other users, bypass authentication in SMB mount operations, and potentially gain unauthorized access to network file shares or escalate privileges.

Statement: This issue is classified as Important severity primarily because a low-privileged local user can achieve full privilege escalation to root without any user interaction. The attack requires local access, which prevents remote exploitation and is the primary factor keeping the rating at Important rather than Critical.

Exploitation requires three components to be present on the system: the `cifs` kernel module (loaded or loadable), the `cifs-utils` package with its default `cifs.spnego` request-key rule, and the ability to create unprivileged user and mount namespaces. All three must be present for the attack chain to succeed. Environments that do not use SMB/CIFS file shares or Active Directory integration are unlikely to have `cifs-utils` installed, reducing their exposure.

In OpenShift Container Platform 4, this flaw is rated Low. The default `restricted-v2` Security Context Constraint (SCC) sets `allowPrivilegeEscalation: false` on all pods, which causes the kernel to ignore setuid file bits, preventing privilege escalation. Under non-default SCCs such as `anyuid` that permit privilege escalation, the vulnerability is constrained by PID and mount namespace isolation to the container's own filesystem. An attacker would only be able to escalate privileges within the container, not on the host or across pods.

Affected upstream versions: 2.6.24
Fixed upstream versions: 0, 5.10.258, 5.15.209, 6.1.175, 6.12.92, 6.18.34, 6.6.142, 7.0.11, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 3da1fdf4efbc490041eb4f836bf596201203f8f2
CVE-2026-46244: kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync
Component: kernel
Severity: Important
CWE: CWE-823 (Use of Out-of-range Pointer Offset)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2026-06-03T00:00:00+00:00

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nft_inner module. This vulnerability arises from an incorrect handling of IPv6 inner packet processing, where the transport header offset (inner_thoff) becomes desynchronized from the Layer 4 protocol (l4proto). A remote attacker could exploit this desynchronization to perform transport header forgery, potentially leading to a firewall bypass and allowing unauthorized network access.

Statement: This is an Important flaw in the Linux kernel's netfilter subsystem, affecting Red Hat Enterprise Linux systems that process IPv6 inner packets. A remote attacker could exploit a desynchronization issue in the `nft_inner` module to forge transport headers, potentially bypassing firewall rules and gaining unauthorized network access.

Affected upstream versions: 6.2
Fixed upstream versions: 0, 6.12.92, 6.18.34, 6.6.142, 7.0.11, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c161ad9157f5a0429b5ff94d9770faf3bf48d273
CVE-2026-46259: kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat()
Component: kernel
Severity: Moderate
CWE: CWE-820 (Missing Synchronization)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-06-03T00:00:00+00:00

A flaw was found in the Linux kernel's procfs component. When reading /proc/[pid]/stat, the do_task_stat() function accesses task->real_parent without proper Read-Copy-Update (RCU) protection. This missing protection creates a race condition, which can lead to a Use-After-Free (UAF) vulnerability. A local attacker could potentially exploit this to cause a system crash or achieve other unspecified impacts.


Affected upstream versions: 2.6.26
Fixed upstream versions: 0, 5.10.252, 5.15.202, 6.1.165, 6.12.75, 6.18.14, 6.19.4, 6.6.128, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fefa0fcd78be465b7ad4c497fa6ec90d64194c04
CVE-2026-46300: kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel
Component: kernel
Severity: Important
CWE: CWE-123 (Write-what-where Condition)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-13T12:00:00+00:00

A flaw was found in the Linux kernel's XFRM ESP-in-TCP subsystem. Unsafe in-place cryptographic processing allows a low-privileged local attacker to write arbitrary bytes into the page cache of read-only files, including sensitive system files. An attacker can exploit this to overwrite privileged binaries and gain root privileges.

Statement: This issue is classified as Important, rather than Critical severity, because exploitation requires local access to the system. A low-privileged local attacker can exploit this flaw in the Linux kernel's XFRM ESP-in-TCP subsystem to gain root privileges by overwriting sensitive system files. Exploitation does not require user interaction, potentially resulting in full compromise of confidentiality, integrity, and availability.

Affected upstream versions: 3.9
Fixed upstream versions: 0, 5.10.257, 5.15.208, 6.1.174, 6.12.91, 6.18.33, 6.6.141, 7.0.10, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3599e6b3cc1ada96883d496a50a210d3afbb6987
CVE-2026-46316: kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry
Component: kernel
Severity: Important
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-06-09T00:00:00+00:00

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) for ARM64, specifically within the vgic-its component. This vulnerability occurs when multiple concurrent operations incorrectly drop the translation cache's reference to an entry more than once during cache invalidation. This leads to a use-after-free condition, which can result in memory corruption. The primary impact is potential system instability or a denial of service.


Affected upstream versions: 6.10
Fixed upstream versions: 0, 6.12.93, 6.18.35, 7.0.12, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b7b72e88046328c9fdc638fe887d4240257dd5dc
CVE-2026-46323: kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs
Component: kernel
Severity: Important
CWE: CWE-123 (Write-what-where Condition)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-19T00:00:00+00:00

A flaw was found in the Linux kernel's Generic Receive Offload (GRO) networking subsystem. This vulnerability occurs when `skb_gro_receive()` attempts to merge zerocopy socket buffers (skbs) without properly managing page reference counts, specifically when the `SKBFL_MANAGED_FRAG_REFS` flag is set. An attacker could potentially exploit this to trigger a Use-After-Free (UAF) condition, which is a memory corruption vulnerability that can lead to system instability or potentially arbitrary code execution.

Statement: This is an Important flaw in the Linux kernel's Generic Receive Offload (GRO) networking subsystem. The vulnerability, a variant of Fragnesia, stems from improper management of page reference counts when merging zerocopy socket buffers. An attacker could exploit this Use-After-Free condition to achieve arbitrary code execution or cause system instability on affected Red Hat Enterprise Linux and OpenShift Container Platform systems.

Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.176, 6.12.92, 6.18.34, 6.6.142, 7.0.11, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1f9c828556416fbe3f49386708ce999fc4d4da06
CVE-2026-46331: kernel: net/sched: act_pedit: extend the writable skb range per key
Component: kernel
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-18T04:04:00+00:00

A flaw was found in the Linux kernel's traffic control packet editing (pedit) subsystem. In tcf_pedit_act(), the copy-on-write (COW) range for skb_ensure_writable() is computed once before iterating over edit keys, but the calculation does not account for runtime header offsets added by typed keys. This can leave part of the target write region without a proper copy-on-write, leading to an out-of-bounds write that corrupts page cache memory. A local attacker with the ability to configure traffic control rules could exploit this to escalate privileges or crash the system.

Statement: Red Hat rates this flaw as Important severity.

This vulnerability is in the kernel's traffic control (tc) pedit action, which requires CAP_NET_ADMIN capability to configure. By default in Red Hat Enterprise Linux, this limits exploitation to the root user or processes explicitly granted network administration capabilities. However, in some circumstances unprivileged users may obtain CAP_NET_ADMIN within user namespaces. Successful exploitation could lead to arbitrary code execution in kernel context or a system crash.

Red Hat Enterprise Linux 7 and earlier are not affected. Within OpenShift Container Platform, the vulnerable module is not loaded by default, reducing the severity to Low.

Affected upstream versions: 5.10.117 < 5.10.260, 5.15.41 < 5.15.211, 4.19.244 < 4.20, 5.4.195 < 5.5, 5.17.9 < 5.18, 5.18
Fixed upstream versions: 0, 4.20, 5.10.260, 5.15.211, 5.18, 5.5, 6.1.177, 6.12.94, 6.18.36, 6.6.144, 7.0.13, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 544d857b42a1734b923040e13aa61a6fd4746cf2
CVE-2026-46333: kernel: Read root-owned files as an unprivileged user
Component: kernel
Severity: Important
CWE: CWE-269 (Improper Privilege Management)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-15T05:55:00+00:00

A vulnerability was found in the Linux kernel that allows an unprivileged local user to read sensitive files normally restricted to the root user. The flaw occurs during process exit, where a brief window allows an attacker to intercept file access from a privileged process before it fully terminates. Successful exploitation may lead to the disclosure of sensitive data such as SSH host private keys or /etc/shadow contents.

Statement: This is an Important flaw in the Linux kernel that allows a local unprivileged attacker to read root-owned files. The vulnerability arises from a race condition during process termination, enabling a brief window where sensitive data, such as SSH host private keys or /etc/shadow contents, can be disclosed. This could lead to unauthorized access to sensitive information on affected Red Hat Enterprise Linux systems.

In OpenShift Container Platform 4, this flaw is rated Low. The default `restricted-v2` Security Context Constraint (SCC) sets `allowPrivilegeEscalation: false` on all pods, which causes the kernel to ignore setuid file bits and prevents target binaries from opening privileged files, breaking the exploit chain entirely. Under non-default SCCs such as `anyuid` that permit privilege escalation, the vulnerability is constrained by PID and mount namespace isolation to the container's own filesystem. An attacker would only be able to access root-owned files already within the container, not host or cross-pod resources. In practice, containers rarely contain sensitive root-owned files that are not already accessible to the pod user through normal means.

Affected upstream versions: 3.16.52 < 3.17, 4.4.40 < 4.5, 4.8.16 < 4.9, 4.9.1 < 4.10, 4.10
Fixed upstream versions: 0, 3.17, 4.10, 4.5, 4.9, 5.10.256, 5.15.207, 6.1.173, 6.12.89, 6.18.31, 6.6.139, 7.0.8, 7.1
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a
CVE-2026-46483: vim: command injection when decompressing .tgz archives
Component: vim
Severity: Moderate
CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-05-15T14:57:31.872000+00:00

A flaw was found in Vim. When decompressing .tgz archives, the Vimuntar function builds shell commands using shellescape() without the {special} flag. This allows a specially crafted archive filename to trigger Vim cmdline-special expansion and execute arbitrary commands in the context of the current user.

Statement: To exploit this issue, an attacker needs to convince a user to decompress a .tgz archive with a specially crafted filename. Additionally, possible arbitrary command execution is restricted to the context of the user running Vim. These conditions limit the exposure of this vulnerability and the potential of a full system compromise. Due to these reasons, this flaw has been rated with a moderate severity.

Affected upstream versions: < 9.2.479
Fixed upstream versions: v9.2.0479
Upstream repository: https://github.com/vim/vim
Upstream fix commit: 3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1
CVE-2026-46625: js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution
Component: js-cookie
Severity: Important
CWE: CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2026-06-10T21:18:05.372000+00:00

A flaw was found in JavaScript Cookie (js-cookie). This vulnerability allows a remote attacker to manipulate cookie attributes by exploiting a prototype pollution issue within the `assign()` helper function. When processing specially crafted JSON input, the flaw enables an attacker to hijack the prototype of a cookie's attribute object. This allows the attacker to set sensitive cookie attributes such as `domain`, `secure`, `samesite`, `expires`, and `path`, potentially leading to security bypasses or session manipulation.


Affected upstream versions: < 3.0.7
Fixed upstream versions: v3.0.7
Upstream repository: https://github.com/js-cookie/js-cookie
Upstream fix commit: eb3c40e89731e99b8970faaf35ddad249c6c0020