huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-23231: kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-03-04T00:00:00+00:00

A flaw was found in the Linux kernel. A local attacker with CAP_NET_ADMIN capabilities, or remote packet traffic, could exploit a use-after-free vulnerability in the nf_tables_addchain() function's error handling. Successful exploitation could lead to a kernel crash, resulting in a Denial of Service (DoS), or potentially privilege escalation.

Statement: A use after free can occur in nf_tables_addchain error handling because a new chain is published to table chains via RCU before hook registration completes and is then freed without an RCU grace period when hook registration fails. This creates a race with RCU readers in the control plane such as nf_tables_dump_chains and also with in flight packet evaluation when an IPv4 hook is transiently installed for NFPROTO_INET and later IPv6 hook registration fails. For the CVSS the PR is L because a local actor with CAP_NET_ADMIN can induce the failing add chain path while remote packet traffic may hit the transient hook and trigger the UAF window. Impact ranges from a kernel crash to potential privilege escalation.

Affected upstream versions: 3.16
Fixed upstream versions: 0, 6.1.165, 6.12.75, 6.18.14, 6.19.4, 6.6.128, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2a6586ecfa4ce1413daaafee250d2590e05f1a33
CVE-2026-23243: kernel: Linux kernel: Denial of service and memory corruption in RDMA umad
Component: kernel
Severity: Moderate
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)
Public date: 2026-03-18T00:00:00+00:00

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) `umad` (User Mode Access Device) component. A local user can exploit this vulnerability by manipulating input, causing an integer underflow that leads to an out-of-bounds memory write. This memory corruption can result in a denial of service (DoS) by crashing the system, and may also lead to limited information disclosure or data integrity issues.

Statement: This bug is a kernel out-of-bounds write in the RDMA umad write path caused by a user-controlled length calculation that could underflow and pass an invalid data_len into MAD send buffer creation.
A local user with access to the umad interface can trigger the issue by supplying mismatched MAD and RMPP header sizes, which leads to an out-of-bounds memset in the send MAD allocation path and can corrupt kernel memory.

Affected upstream versions: 2.6.24
Fixed upstream versions: 0, 5.10.252, 5.15.202, 6.1.165, 6.12.75, 6.18.14, 6.19.4, 6.6.128, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1371ef6b1ecf3676b8942f5dfb3634fb0648128e
CVE-2026-2327: markdown-it: markdown-it: Denial of Service via Regular Expression Denial of Service in linkify function
Component: markdown-it
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-02-12T05:00:07.369000+00:00

A flaw was found in markdown-it. A remote attacker can exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted input containing a long sequence of asterisk characters followed by a non-matching character to the `linkify` function. This triggers excessive backtracking in the regular expression, leading to a denial-of-service condition.


Affected upstream versions: 13.0.0 < 14.1.1
Fixed upstream versions: 14.1.1
Upstream repository: https://github.com/markdown-it/markdown-it
Upstream fix commit: 4b4bbcae5e0990a5b172378e507b33a59012ed26
CVE-2026-23270: kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-03-18T00:00:00+00:00

A flaw was found in the Linux kernel. A use-after-free vulnerability exists in the traffic control `act_ct` path when it is incorrectly configured with non-ingress egress qdiscs (queueing disciplines). This can allow a local user with specific privileges to trigger a kernel crash, leading to a denial of service. In some cases, this vulnerability may also be exploited for privilege escalation.

Statement: A use after free risk exists in the traffic control act_ct path when it is attached to non ingress egress qdiscs. In this configuration classify can return TC_ACT_CONSUMED while the skb is still held by the defragmentation engine. That can result in the skb being consumed and later accessed again by defragmentation which may lead to a kernel crash. Impact is denial of service in the common case, but keeping in mind that a kernel UAF could be exploitable for privilege escalation in some cases. The bug could happen only if some specific configuration being used (when tc/action being used and if the act_ct linked to incorrect qdisc/block), and in some cases regular user (if with some privileges) can make such configuration.
The bug is not triggerable until some specific configuration being used, so considered with limited impact level.

Affected upstream versions: 5.15.148 < 5.15.203, 6.1.75 < 6.1.167, 6.6.14 < 6.6.130, 6.7.2 < 6.8, 6.8
Fixed upstream versions: 0, 5.15.203, 6.1.167, 6.12.77, 6.18.18, 6.19.8, 6.6.130, 6.8, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: bc4e5bb529823a09f02dbe96169de679a9db26e0
CVE-2026-23375: kernel: mm: thp: deny THP for files on anonymous inodes
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-03-25T00:00:00+00:00

A flaw was found in the Linux kernel's Transparent Huge Pages (THP) mechanism. This vulnerability occurs because the `file_thp_enabled()` function incorrectly allows THP for files on anonymous inodes, which are not designed for this feature. An attacker could potentially exploit this by manipulating specific memory operations, leading to a kernel crash when handling secret memory pages. Additionally, it can cause incorrect memory failure reports for guest memory files.

Statement: This flaw affects systems using THP with guest_memfd (KVM) or secretmem. Anonymous inodes incorrectly pass THP eligibility checks, causing khugepaged to create large folios that these subsystems don't support. For secretmem, collapse_file() accesses pages removed from direct map, causing crashes. Requires CONFIG_READ_ONLY_THP_FOR_FS and use of affected pseudo-filesystems.

Affected upstream versions: 6.8
Fixed upstream versions: 0, 6.12.78, 6.18.17, 6.19.7, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 08de46a75f91a6661bc1ce0a93614f4bc313c581
CVE-2026-23392: kernel: netfilter: nf_tables: release flowtable after rcu grace period on error
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-03-25T00:00:00+00:00

A flaw was found in the Linux kernel's netfilter component, specifically within the nf_tables subsystem. An error in releasing a flowtable after an RCU (Read-Copy-Update) grace period could lead to a use-after-free vulnerability. This issue could expose the flowtable to the packet path and nfnetlink_hook control plane, potentially allowing a local attacker to cause a system crash (Denial of Service) or achieve arbitrary code execution.

Statement: This flaw affects nftables flowtable configurations. When flowtable setup fails (max hooks reached, hardware offload failure, or duplicate device), the error path frees the flowtable without synchronize_rcu(), allowing concurrent access from packet path or nfnetlink_hook. KASAN detected this as UAF during hook dumping.

Affected upstream versions: 4.16
Fixed upstream versions: 0, 6.1.167, 6.12.78, 6.18.20, 6.19.10, 6.6.130, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d2632de96ccb066e0131ad1494241b9c281c60b8
CVE-2026-23401: kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 8.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Public date: 2026-04-01T00:00:00+00:00

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) component. A local attacker with privileges on the host system could exploit a vulnerability in how KVM handles shadow page table entries (SPTEs) during memory-mapped I/O (MMIO) operations. By manipulating guest page table entries (gPTEs) from host userspace, an attacker could cause KVM to install an MMIO SPTE without properly removing an existing shadow-present SPTE. This improper handling could lead to a kernel warning, resulting in a denial of service or potentially allowing for privilege escalation or information disclosure.

Statement: This is an Important impact vulnerability. A flaw in the KVM's x86/mmu component in the Linux kernel could allow a privileged guest user to trigger a host denial of service. This issue occurs when host userspace modifies a shadowed gPTE to switch from a memslot to emulated MMIO, leading to a missing SPTE zap. Red Hat Enterprise Linux 8, 9, and 10, and Red Hat In-Vehicle OS are affected. Red Hat Enterprise Linux 6 and 7 are not affected.

Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.203, 6.1.168, 6.12.80, 6.18.21, 6.19.11, 6.6.131, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 20656cd1f243d3a154aac5dd1b823110b6906fe1
CVE-2026-23455: kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-04-03T00:00:00+00:00

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the `nf_conntrack_h323` module. This vulnerability occurs in the `DecodeQ931()` function when processing a zero-length value from a packet. An integer underflow during a length calculation results in a large, incorrect value being passed to a subsequent function, leading to an out-of-bounds read. This could allow an attacker to cause a denial of service or potentially disclose sensitive information.


Affected upstream versions: 2.6.17
Fixed upstream versions: 0, 5.10.253, 5.15.203, 6.1.167, 6.12.78, 6.18.20, 6.19.10, 6.6.130, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2121f5fbe88daff0f1fc5bc47d359426c74b86b0
CVE-2026-23490: pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID
Component: pyasn1
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-01-16T19:03:36.442000+00:00

A flaw was found in pyasn1, a generic ASN.1 library for Python. A remote attacker could exploit this vulnerability by sending a specially crafted RELATIVE-OID with excessive continuation octets. This input validation vulnerability leads to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.


Affected upstream versions: < 0.6.2
Fixed upstream versions: v0.6.2
Upstream repository: https://github.com/pyasn1/pyasn1
Upstream fix commit: 3908f144229eed4df24bd569d16e5991ace44970
CVE-2026-2359: multer: Multer: Denial of Service via dropped file upload connections
Component: multer
Severity: Important
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-02-27T15:42:08.088000+00:00

A flaw was found in Multer, a Node.js middleware for handling `multipart/form-data`. A remote attacker can exploit this vulnerability by intentionally dropping a connection during a file upload. This can lead to a Denial of Service (DoS) due to resource exhaustion on the affected system.


Affected upstream versions: 0.0.0 < 2.1.0
Fixed upstream versions: 2.1.0
Upstream repository: https://github.com/expressjs/multer
Upstream fix commit: cccf0fe0e64150c4f42ccf6654165c0d66b9adab
CVE-2026-23679: libusb: libusb: Denial of Service via malformed USB configuration descriptor
Component: libusb
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-05-27T13:21:37.035000+00:00

A flaw was found in libusb. An attacker can provide a specially crafted Universal Serial Bus (USB) configuration descriptor to applications using libusb. This malformed descriptor can lead to a null pointer dereference, causing the application to crash and resulting in a denial of service. This vulnerability can be exploited via virtualized USB passthrough, file-based descriptor parsing, or network sources.

Statement: This Moderate flaw in libusb can lead to a denial of service when processing a specially crafted USB configuration descriptor. Exploitation requires an application to handle such a malformed descriptor, which can occur through virtualized USB passthrough, file-based parsing, or network sources. This issue primarily impacts system availability and does not enable arbitrary code execution.

Affected upstream versions: <= v1.0.29
Fixed upstream versions: 1.0.30
Upstream repository: https://github.com/libusb/libusb
Upstream fix commit: 578ab76b4c434f8b204137ab6d7310689c7a9704
CVE-2026-23745: node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives
Component: node-tar
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 8.2 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
Public date: 2026-01-16T22:00:08.769000+00:00

A flaw was found in the node-tar library. This vulnerability allows an attacker to craft malicious archives that, when extracted, can bypass intended security restrictions. This leads to arbitrary file overwrite and symlink poisoning, potentially allowing unauthorized modification of files on the system.

Statement: This vulnerability is rated Important for Red Hat products that utilize the node-tar library. The flaw allows an attacker to perform arbitrary file overwrite and symlink poisoning by crafting malicious tar archives. This occurs due to insufficient path sanitization of hardlink and symbolic link entries, even when the default secure behavior (preservePaths is false) is enabled.

Affected upstream versions: < 7.5.3
Fixed upstream versions: v7.5.3
Upstream repository: https://github.com/isaacs/node-tar
Upstream fix commit: 340eb285b6d986e91969a1170d7fe9b0face405e
CVE-2026-23831: github.com/sigstore/rekor: Rekor denial of service
Component: github.com/sigstore/rekor
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-01-22T21:26:22.183000+00:00

Rekor’s cose v0.0.1 entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty spec.message. validate() returns nil (success) when message is empty, leaving sign1Msg uninitialized, and Canonicalize() later dereferences v.sign1Msg.Payload. A malformed proposed entry of the cose/v0.0.1 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal.


Affected upstream versions: < 1.5.0
Fixed upstream versions: v1.5.0
Upstream repository: https://github.com/sigstore/rekor
Upstream fix commit: 39bae3d192bce48ef4ef2cbd1788fb5770fee8cd
CVE-2026-23865: freetype: Information disclosure or denial of service via specially crafted font files
Component: freetype
Severity: Moderate
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Public date: 2026-03-02T16:09:42.079000+00:00

A flaw was found in Freetype. An integer overflow vulnerability exists when processing specially crafted OpenType variable fonts. A local attacker could exploit this by convincing a user to open a malicious font file, which may lead to an out-of-bounds read and potential information disclosure or denial of service.

Statement: This is a MODERATE impact vulnerability. An integer overflow in the Freetype library can lead to an out-of-bounds read when processing specially crafted OpenType variable fonts. Exploitation requires user interaction, such as opening a malicious font file.

Affected upstream versions: 2.13.2 <= 2.13.3, 2.14.0 <= 2.14.1
Fixed upstream versions: VER-2-14-2
Upstream repository: https://gitlab.com/freetype/freetype
Upstream fix commit: fc85a255849229c024c8e65f536fe1875d84841c
CVE-2026-23876: ImageMagick: ImageMagick: Arbitrary code execution via a crafted XBM image file
Component: ImageMagick
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-01-20T01:01:38.527000+00:00

A flaw was found in ImageMagick. A heap buffer overflow, a type of memory corruption, in the XBM image decoder (ReadXBMImage) allows a remote attacker to write controlled data beyond the allocated memory buffer when processing a maliciously crafted image file. This can lead to arbitrary code execution, information disclosure, or a denial of service. The vulnerability can be triggered by any operation that reads or identifies an image.

Statement: This vulnerability is rated Important for Red Hat products as it affects ImageMagick, a widely used image manipulation suite. A heap buffer overflow in the XBM image decoder can be triggered by processing a specially crafted image file, potentially leading to arbitrary code execution or denial of service. Exploitation can occur through common image upload and processing pipelines.

Affected upstream versions: < 7.1.2-13, < 6.9.13-38
Fixed upstream versions: 7.1.2-13
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: 2fae24192b78fdfdd27d766fd21d90aeac6ea8b8
CVE-2026-23893: openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following
Component: openCryptoki
Severity: Moderate
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 6.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L)
Public date: 2026-01-22T00:01:43.521000+00:00

A flaw was found in openCryptoki, a PKCS#11 library and tooling for Linux and AIX. A token-group user can exploit a symlink-following vulnerability by planting symbolic links in group-writable token directories. When an administrator runs a PKCS#11 application or administrative tool as root, it may reset ownership or permissions on existing files within these directories. This can lead to privilege escalation or the exposure of sensitive data.

Statement: This vulnerability is rated Moderate for Red Hat because it requires a local attacker with `token-group` membership to plant symbolic links in group-writable token directories. Exploitation occurs when an administrator subsequently runs a privileged `openCryptoki` application or administrative tool, leading to privilege escalation or data exposure. Red Hat systems are affected if `openCryptoki` is installed and configured with group-writable token directories.

Affected upstream versions: >= 2.3.2
Fixed upstream versions: v3.27.0
Upstream repository: https://github.com/opencryptoki/opencryptoki
Upstream fix commit: 5e6e4b42f2b1fcc1e4ef1b920e463bfa55da8b45
CVE-2026-23948: freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2()
Component: freerdp
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-02-09T18:12:00.737000+00:00

A null pointer dereference has been discovered in FreeRDP. A NULL pointer dereference vulnerability in rdp_write_logon_info_v2() allows a malicious RDP server to crash FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with cbDomain=0 or cbUserName=0.

Statement: Availability impact is limited to the FreeRDP instance on Red Hat Products. General system availability is not at risk.

Affected upstream versions: < 3.22.0
Fixed upstream versions: 3.22.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 4d44e3c097656a8b9ec696353647b0888ca45860
CVE-2026-23950: node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition
Component: node-tar
Severity: Important
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L)
Public date: 2026-01-20T00:40:48.510000+00:00

A flaw was found in node-tar, a library for Node.js. This race condition vulnerability occurs due to incomplete handling of Unicode path collisions within the `path-reservations` system on case-insensitive filesystems, such as macOS APFS. A remote attacker can exploit this by providing a specially crafted tar archive containing filenames that cause these collisions, bypassing internal concurrency safeguards. Successful exploitation can lead to arbitrary file overwrite.

Statement: This vulnerability is rated Important for Red Hat products. The `node-tar` library is susceptible to a race condition due to incomplete handling of Unicode path collisions, which can lead to arbitrary file overwrites via symlink poisoning. However, this issue primarily affects case-insensitive or normalization-insensitive filesystems. Red Hat Enterprise Linux and other Red Hat products typically utilize case-sensitive filesystems, which may limit the direct impact of this flaw in default configurations.

Affected upstream versions: < 7.5.4
Fixed upstream versions: v7.5.4
Upstream repository: https://github.com/isaacs/node-tar
Upstream fix commit: 3b1abfae650056edfabcbe0a0df5954d390521e6
CVE-2026-24040: jsPDF: jsPDF: Cross-User Data Leakage via race condition in addJS method
Component: jsPDF
Severity: Moderate
CWE: CWE-820 (Missing Synchronization)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N)
Public date: 2026-02-02T20:38:24.732000+00:00

A flaw was found in jsPDF. When jsPDF is used in a concurrent environment, such as a Node.js web server, a race condition in the addJS method can lead to cross-user data leakage. This occurs because a shared variable used to store JavaScript content can be overwritten by simultaneous requests. As a result, a PDF generated for one user may contain sensitive JavaScript content intended for another user, leading to unauthorized information disclosure.

Statement: This MODERATE impact vulnerability in jsPDF affects applications utilizing the `addJS` method in a concurrent server-side Node.js environment. A shared module-scoped variable can lead to cross-user data leakage when multiple PDF generation requests occur simultaneously, potentially embedding sensitive data from one user into another's PDF. This primarily impacts server-side deployments where jsPDF is used to generate documents concurrently.

Affected upstream versions: < 4.1.0
Fixed upstream versions: v4.1.0
Upstream repository: https://github.com/parallax/jsPDF
Upstream fix commit: 2863e5c26afef211a545e8c174ab4d5fce3b8c0e