huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-3159: assimp: Open Asset Import Library Assimp ASE File ASEParser.cpp ParseLV4MeshBonesVertices heap-based overflow
Component: assimp
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2025-04-03T14:00:17.038000+00:00

A flaw has been found in the Open Asset Import Library (assimp). In affected versions, a malformed ASE file may trigger a heap-based buffer overflow, which may lead to an application crash or other undefined behavior.


Affected upstream versions: 5.4.3
Upstream repository: https://github.com/tellypresence/assimp
Upstream fix commit: e8a6286542924e628e02749c4f5ac4f91fdae71b
CVE-2025-32023: redis: Redis Hyperloglog Out-of-Bounds Write Vulnerability
Component: redis
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-07-07T15:22:19.155000+00:00

A flaw was found in Redis. This flaw allows an authenticated user to trigger an integer overflow by sending a specially crafted string, resulting in a stack or heap out-of-bounds write during hyperloglog operations. This issue potentially results in remote code execution.

Statement: This flaw can only be exploited by an authenticated attacker when the Redis server has hyperloglog operations implemented, limiting the impact of this issue.

Affected upstream versions: >= 8.0.0, < 8.0.3, >= 7.4-rc1, < 7.4.5, >= 7.0.0, < 7.2.10, >= 2.8.0, < 6.2.19
Fixed upstream versions: 8.0.3
Upstream repository: https://github.com/redis/redis
Upstream fix commit: 50188747cbfe43528d2719399a2a3c9599169445
CVE-2025-32728: openssh: OpenSSH SSHD Agent Forwarding and X11 Forwarding
Component: openssh
Severity: Moderate
CWE: CWE-440 (Expected Behavior Violation)
CVSS v3: 4.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N)
Public date: 2025-04-10T00:00:00+00:00

A flaw was found in OpenSSH. In affected versions of sshd, the DisableForwarding directive does not fully adhere to the intended functionality as documented. Specifically, it fails to disable X11 and agent forwarding, which may allow unintended access under certain configurations.


Affected upstream versions: 7.4 < 10.0
Fixed upstream versions: 10.0
Upstream repository: https://github.com/openssh/openssh-portable
Upstream fix commit: fc86875e6acb36401dfc1dfb6b628a9d1460f367
CVE-2025-32996: http-proxy-middleware: Always-Incorrect Control Flow Implementation in http-proxy-middleware
Component: http-proxy-middleware
Severity: Moderate
CWE: CWE-670 (Always-Incorrect Control Flow Implementation)
CVSS v3: 4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L)
Public date: 2025-04-15T00:00:00+00:00

A flaw was found http-proxy-middleware. This vulnerability affects http-proxy-middleware versions where the writeBody function can be called twice due to improper control flow handling.


Affected upstream versions: 3.0.0 < 3.0.4
Fixed upstream versions: 2.0.8, 3.0.4
Upstream repository: https://github.com/chimurai/http-proxy-middleware
Upstream fix commit: 020976044d113fc0bcbbaf995e91d05e2829a145
CVE-2025-32997: http-proxy-middleware: Improper Check for Unusual or Exceptional Conditions in http-proxy-middleware
Component: http-proxy-middleware
Severity: Moderate
CWE: CWE-754 (Improper Check for Unusual or Exceptional Conditions)
CVSS v3: 4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N)
Public date: 2025-04-15T00:00:00+00:00

A flaw was found in http-proxy-middleware. The issue occurs because the fixRequestBody function proceeds even when bodyParser has failed, which could lead to unintended behavior.


Affected upstream versions: 3.0.0 < 3.0.5
Fixed upstream versions: 2.0.9, 3.0.5
Upstream repository: https://github.com/chimurai/http-proxy-middleware
Upstream fix commit: 1bdccbeec243850f1d2bb50ea0ff2151e725d67e
CVE-2025-33042: org.apache.avro/avro: Apache Avro Java SDK: Code injection on Java generated code
Component: org.apache.avro/avro
Severity: Moderate
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 5.6 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2026-02-13T11:47:03.783000+00:00

A code injection flaw has been discovered in Apache Avro. This vulnerability manifests when generating specific records from untrusted Avro schemas.


Affected upstream versions: 1.12.0
Upstream repository: https://github.com/apache/avro
Upstream fix commit: 84bc7322ca1c04ab4a8e4e708acf1e271541aac4
CVE-2025-35036: hibernate-validator: Hibernate Validator Expression Language Injection
Component: hibernate-validator
Severity: Important
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2025-06-03T19:27:42.900000+00:00

A flaw was found in Hibernate Validator. This vulnerability allows unauthorized access to sensitive information or the execution of arbitrary Java code by interpolating user-supplied input in a constraint violation message with an Expression Language.

Statement: This vulnerability marked as Important rather than Moderate because it enables Expression Language (EL) injection through user-supplied input embedded in validation messages — effectively escalating a benign validation failure into a potential Remote Code Execution (RCE) vector. In environments where EL expressions have access to application internals, attackers can craft payloads that access sensitive Java objects, invoke arbitrary methods, or manipulate server-side logic. The fact that this behavior is triggered by the default configuration — without any explicit developer error — further amplifies the risk.

Affected upstream versions: <= 6.1.2.Final
Fixed upstream versions: 6.2.0, 7.0.0
Upstream repository: https://github.com/hibernate/hibernate-validator
Upstream fix commit: 05f795bb7cf18856004f40e5042709e550ed0d6e
CVE-2025-37738: kernel: ext4: ignore xattrs past end
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-05-01T00:00:00+00:00

A use-after-free vulnerability has been discovered in the Linux kernel, specifically within the ext4_xattr_inode_dec_ref_all function (related to the ext4 filesystem's extended attributes). An attacker could exploit this flaw by providing a specially crafted payload, leading to a denial of service condition that compromises system availability.


Affected upstream versions: 4.13
Fixed upstream versions: 0, 5.10.237, 5.15.181, 5.4.293, 6.1.135, 6.12.24, 6.13.12, 6.14.3, 6.15, 6.6.88
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6aff941cb0f7d0c897c3698ad2e30672709135e3
CVE-2025-37749: kernel: net: ppp: Add bound checking for skb data on ppp_sync_txmung
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2025-05-01T00:00:00+00:00

An out-of-bounds read vulnerability exists in the ppp_sync_txmunge() function in the Linux kernel's PPP subsystem. Insufficient bounds checking on incoming PPP packets may lead to a kernel crash if a packet with an empty or truncated payload is processed.

Statement: This is rated Moderate because it involves an out-of-bounds read, not write, in the ppp_sync_txmunge() function, triggered by malformed PPP packets with insufficient linear data. While it can cause a kernel crash (DoS), exploitation is limited as PPP is not widely used or exposed in most modern systems. The affected path requires a crafted PPPoE packet and direct access to a PPP interface, reducing its overall impact and likelihood of exploitation.

Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.10.237, 5.15.181, 5.4.293, 6.1.135, 6.12.24, 6.13.12, 6.14.3, 6.15, 6.6.88
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 529401c8f12ecc35f9ea5d946d5a5596cf172b48
CVE-2025-37750: kernel: smb: client: fix UAF in decryption with multichannel
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-05-01T00:00:00+00:00

A use-after-free (UAF) vulnerability was found in the Linux kernel's SMB client functionality. A local attacker with permissions to connect to arbitrary SMB servers with precise timing could exploit this flaw to alter system memory, leading to denials of service, alteration of sensitive memory locations, or privilege escalation.

Statement: This vulnerability exists in how the SMB client manages cryptography for multi-channel connections. When using multi-channel connections, there is a possibility that a race condition will occur in separate threads. In that case, it is possible for one thread to free memory related to cryptography before another thread accesses it. An attacker could leverage that vulnerability to modify kernel memory, which could result in an escalation of privileges as well as potentially impacting system stability and integrity.

The changes in multichannel SMB client cryptography management that led to this vulnerability are not present in Red Hat Enterprise Linux prior to 9.6.

Affected upstream versions: 5.10.237 < 5.11, 5.15.181 < 5.16, 6.1.128 < 6.2, 6.6.57 < 6.7, 6.11.4 < 6.12, 6.12
Fixed upstream versions: 0, 5.11, 5.16, 6.12, 6.12.24, 6.13.12, 6.14.3, 6.15, 6.2, 6.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: aa5a1e4b882964eb79d5b5d1d1e8a1a5efbb1d15
CVE-2025-37761: kernel: Linux kernel drm/xe: Out-of-bounds shift in TLB invalidation
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-05-01T00:00:00+00:00

A flaw was found in the Linux kernel's drm/xe component. This vulnerability allows a local attacker to cause a denial of service or information disclosure via an out-of-bounds shift during TLB invalidation.


Affected upstream versions: 6.8
Fixed upstream versions: 0, 6.12.25, 6.14.4, 6.15
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 28477f701b63922ff88e9fb13f5519c11cd48b86
CVE-2025-37785: kernel: ext4: fix OOB read when checking dotdot dir
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-04-18T00:00:00+00:00

A flaw was found in the ext4 module in the Linux kernel. An out-of-bounds read can be triggered when a corrupted ext4 filesystem is mounted due to a missing check, resulting in a denial of service that causes the system to freeze or become unusable.

Statement: This flaw can only be exploited when a corrupted '.' (dot) directory is removed from a corrupted ext4 filesystem. As this issue has limited exposure and can only cause a system crash, it is rated with a Moderate severity.

Affected upstream versions: 2.6.19
Fixed upstream versions: 0, 5.10.236, 5.15.180, 5.4.293, 6.1.134, 6.12.23, 6.13.11, 6.14.2, 6.15, 6.6.87
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 14da7dbecb430e35b5889da8dae7bef33173b351
CVE-2025-37789: kernel: Linux kernel (openvswitch): Denial of Service and limited data exposure via improper key length validation
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2025-05-01T00:00:00+00:00

A flaw was found in the Linux kernel's openvswitch virtual environment. A local attacker with low privileges could exploit improper data and key length validation in the `set()` action. This could lead to a denial of service, making the system unresponsive, and potentially result in limited information disclosure.

Statement: A denial of service, and a limited data exposure can be observed if the data/key validation is not correctly validated in validate_set in net/openvswitch/flow_netlink.c in the Linux Kernel openvswitch virtual environment.  

This flaw could allow an attacker to crash the system or leak internal kernel information problem.

Affected upstream versions: 3.3
Fixed upstream versions: 0, 5.10.237, 5.15.181, 5.4.293, 6.1.135, 6.12.25, 6.14.4, 6.15, 6.6.88
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 54c6957d1123a2032099b9eab51c314800f677ce
CVE-2025-37797: kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-05-02T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net_sched: hfsc: Fix a UAF vulnerability in class handling

This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class
handling. The issue occurs due to a time-of-check/time-of-use condition
in hfsc_change_class() when working with certain child qdiscs like netem
or codel.

The vulnerability works as follows:
1. hfsc_change_class() checks if a class has packets (q.qlen != 0)
2. It then calls qdisc_peek_len(), which for certain qdiscs (e.g.,
   codel, netem) might drop packets and empty the queue
3. The code continues assuming the queue is still non-empty, adding
   the class to vttree
4. This breaks HFSC scheduler assumptions that only non-empty classes
   are in vttree
5. Later, when the class is destroyed, this can lead to a Use-After-Free

The fix adds a second queue length check after qdisc_peek_len() to verify
the queue wasn't emptied.

Statement: The bug could happen only when qdisc with child qdiscs like netem or codel being used.

Affected upstream versions: 4.14
Fixed upstream versions: 0, 5.10.237, 5.15.181, 5.4.293, 6.1.136, 6.12.26, 6.14.5, 6.15, 6.6.89
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 28b09a067831f7317c3841812276022d6c940677
CVE-2025-37799: kernel: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp
Component: kernel
Severity: Important
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N)
Public date: 2025-05-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp

vmxnet3 driver's XDP handling is buggy for packet sizes using ring0 (that
is, packet sizes between 128 - 3k bytes).

We noticed MTU-related connectivity issues with Cilium's service load-
balancing in case of vmxnet3 as NIC underneath. A simple curl to a HTTP
backend service where the XDP LB was doing IPIP encap led to overly large
packet sizes but only for *some* of the packets (e.g. HTTP GET request)
while others (e.g. the prior TCP 3WHS) looked completely fine on the wire.

In fact, the pcap recording on the backend node actually revealed that the
node with the XDP LB was leaking uninitialized kernel data onto the wire
for the affected packets, for example, while the packets should have been
152 bytes their actual size was 1482 bytes, so the remainder after 152 bytes
was padded with whatever other data was in that page at the time (e.g. we
saw user/payload data from prior processed packets).

We only noticed this through an MTU issue, e.g. when the XDP LB node and
the backend node both had the same MTU (e.g. 1500) then the curl request
got dropped on the backend node's NIC given the packet was too large even
though the IPIP-encapped packet normally would never even come close to
the MTU limit. Lowering the MTU on the XDP LB (e.g. 1480) allowed to let
the curl request succeed (which also indicates that the kernel ignored the
padding, and thus the issue wasn't very user-visible).

Commit e127ce7699c1 ("vmxnet3: Fix missing reserved tailroom") was too eager
to also switch xdp_prepare_buff() from rcd->len to rbi->len. It really needs
to stick to rcd->len which is the actual packet length from the descriptor.
The latter we also feed into vmxnet3_process_xdp_small(), by the way, and
it indicates the correct length needed to initialize the xdp->{data,data_end}
parts. For e127ce7699c1 ("vmxnet3: Fix missing reserved tailroom") the
relevant part was adapting xdp_init_buff() to address the warning given the
xdp_data_hard_end() depends on xdp->frame_sz. With that fixed, traffic on
the wire looks good again.

Statement: A bug in the vmxnet3 XDP path caused uninitialized kernel memory to be leaked into network packets, due to incorrect packet size handling.
This results in a kernel memory disclosure to remote systems, affecting confidentiality but not system stability.

RHEL versions prior to 9.5 are not affected by this vulnerability, as the vulnerable code is not present in those releases.

Affected upstream versions: 6.6.23 < 6.6.89, 6.7.11 < 6.8, 6.8.2 < 6.9, 6.9
Fixed upstream versions: 0, 6.12.26, 6.14.5, 6.15, 6.6.89, 6.8, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c4312c4d244aa58e811ff0297e013124d115e793
CVE-2025-37803: kernel: udmabuf: fix a buf size overflow issue during udmabuf creation
Component: kernel
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)
Public date: 2025-05-08T00:00:00+00:00

A buffer-overflow vulnerability was found in the Linux kernel's udmabuf driver. The flaw occurs in the `udmabuf_create()` function, which calculates the page count limit (`pglimit`) using the variable `size_limit_mb`. This size variable can be misinterpreted as either 32-bit or 64-bit, resulting in incorrect page limit checks and allocating a larger DMA buffer than permitted. This issue can lead to memory corruption, system instability, and a denial of service.

Statement: An integer overflow in udmabuf_create can occur when computing the page limit from size_limit_mb using 32 bit arithmetic before shifting. This can cause pglimit to wrap and may break the intended buffer size enforcement, allowing a local user with access to the udmabuf device to request unexpectedly large allocations. The issue is not network reachable and does not imply memory corruption by itself. Impact is primarily denial of service via memory pressure or allocation failures.

Affected upstream versions: 4.20
Fixed upstream versions: 0, 5.10.237, 5.15.181, 5.4.293, 6.1.136, 6.12.57, 6.14.5, 6.15, 6.6.89
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e84a08fc7e25cdad5d9a3def42cc770ff711193f
CVE-2025-37810: kernel: usb: dwc3: gadget: check that event count does not exceed event buffer length
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-05-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: gadget: check that event count does not exceed event buffer length

The event count is read from register DWC3_GEVNTCOUNT.
There is a check for the count being zero, but not for exceeding the
event buffer length.
Check that event count does not exceed event buffer length,
avoiding an out-of-bounds access when memcpy'ing the event.
Crash log:
Unable to handle kernel paging request at virtual address ffffffc0129be000
pc : __memcpy+0x114/0x180
lr : dwc3_check_event_buf+0xec/0x348
x3 : 0000000000000030 x2 : 000000000000dfc4
x1 : ffffffc0129be000 x0 : ffffff87aad60080
Call trace:
__memcpy+0x114/0x180
dwc3_interrupt+0x24/0x34


Affected upstream versions: 3.2
Fixed upstream versions: 0, 5.10.237, 5.15.181, 5.4.293, 6.1.136, 6.12.26, 6.14.5, 6.15, 6.6.89
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 015c39f38e69a491d2abd5e98869a500a9459b3b
CVE-2025-37819: kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-05-08T00:00:00+00:00

A flaw was found in the Linux kernel's irqchip/gic-v2m component. This vulnerability allows a use-after-free condition via gicv2m_get_fwnode() being wrongly marked as __init, causing it to be freed while still registered with the PCI (Peripheral Component Interconnect) subsystem during a PCI host bridge probe.

Statement: A use-after-free flaw was found in the Linux kernel irqchip/gic-v2m module during a PCI host bridge probe, where a privileged user (PR:H) may access a callback which is already freed with the PCI
subsystem leading to a DoS and kernel information leak problem.

Affected upstream versions: 4.5
Fixed upstream versions: 0, 5.10.238, 5.15.182, 5.4.294, 6.1.138, 6.12.26, 6.14.5, 6.15, 6.6.89
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0c241dedc43a036599757cd08f356253fa3e5014
CVE-2025-37821: kernel: sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-05-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash

There is a code path in dequeue_entities() that can set the slice of a
sched_entity to U64_MAX, which sometimes results in a crash.

The offending case is when dequeue_entities() is called to dequeue a
delayed group entity, and then the entity's parent's dequeue is delayed.
In that case:

1. In the if (entity_is_task(se)) else block at the beginning of
   dequeue_entities(), slice is set to
   cfs_rq_min_slice(group_cfs_rq(se)). If the entity was delayed, then
   it has no queued tasks, so cfs_rq_min_slice() returns U64_MAX.
2. The first for_each_sched_entity() loop dequeues the entity.
3. If the entity was its parent's only child, then the next iteration
   tries to dequeue the parent.
4. If the parent's dequeue needs to be delayed, then it breaks from the
   first for_each_sched_entity() loop _without updating slice_.
5. The second for_each_sched_entity() loop sets the parent's ->slice to
   the saved slice, which is still U64_MAX.

This throws off subsequent calculations with potentially catastrophic
results. A manifestation we saw in production was:

6. In update_entity_lag(), se->slice is used to calculate limit, which
   ends up as a huge negative number.
7. limit is used in se->vlag = clamp(vlag, -limit, limit). Because limit
   is negative, vlag > limit, so se->vlag is set to the same huge
   negative number.
8. In place_entity(), se->vlag is scaled, which overflows and results in
   another huge (positive or negative) number.
9. The adjusted lag is subtracted from se->vruntime, which increases or
   decreases se->vruntime by a huge number.
10. pick_eevdf() calls entity_eligible()/vruntime_eligible(), which
    incorrectly returns false because the vruntime is so far from the
    other vruntimes on the queue, causing the
    (vruntime - cfs_rq->min_vruntime) * load calulation to overflow.
11. Nothing appears to be eligible, so pick_eevdf() returns NULL.
12. pick_next_entity() tries to dereference the return value of
    pick_eevdf() and crashes.

Dumping the cfs_rq states from the core dumps with drgn showed tell-tale
huge vruntime ranges and bogus vlag values, and I also traced se->slice
being set to U64_MAX on live systems (which was usually "benign" since
the rest of the runqueue needed to be in a particular state to crash).

Fix it in dequeue_entities() by always setting slice from the first
non-empty cfs_rq.


Affected upstream versions: 6.12
Fixed upstream versions: 0, 6.12.29, 6.14.5, 6.15
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 86b37810fa1e40b93171da023070b99ccbb4ea04