huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-68183: kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
Component: kernel
Severity: Moderate
CWE: CWE-354 (Improper Validation of Integrity Check Value)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-12-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

Currently when both IMA and EVM are in fix mode, the IMA signature will
be reset to IMA hash if a program first stores IMA signature in
security.ima and then writes/removes some other security xattr for the
file.

For example, on Fedora, after booting the kernel with "ima_appraise=fix
evm=fix ima_policy=appraise_tcb" and installing rpm-plugin-ima,
installing/reinstalling a package will not make good reference IMA
signature generated. Instead IMA hash is generated,

    # getfattr -m - -d -e hex /usr/bin/bash
    # file: usr/bin/bash
    security.ima=0x0404...

This happens because when setting security.selinux, the IMA_DIGSIG flag
that had been set early was cleared. As a result, IMA hash is generated
when the file is closed.

Similarly, IMA signature can be cleared on file close after removing
security xattr like security.evm or setting/removing ACL.

Prevent replacing the IMA file signature with a file hash, by preventing
the IMA_DIGSIG flag from being reset.

Here's a minimal C reproducer which sets security.selinux as the last
step which can also replaced by removing security.evm or setting ACL,

    #include <stdio.h>
    #include <sys/xattr.h>
    #include <fcntl.h>
    #include <unistd.h>
    #include <string.h>
    #include <stdlib.h>

    int main() {
        const char* file_path = "/usr/sbin/test_binary";
        const char* hex_string = "030204d33204490066306402304";
        int length = strlen(hex_string);
        char* ima_attr_value;
        int fd;

        fd = open(file_path, O_WRONLY|O_CREAT|O_EXCL, 0644);
        if (fd == -1) {
            perror("Error opening file");
            return 1;
        }

        ima_attr_value = (char*)malloc(length / 2 );
        for (int i = 0, j = 0; i < length; i += 2, j++) {
            sscanf(hex_string + i, "%2hhx", &ima_attr_value[j]);
        }

        if (fsetxattr(fd, "security.ima", ima_attr_value, length/2, 0) == -1) {
            perror("Error setting extended attribute");
            close(fd);
            return 1;
        }

        const char* selinux_value= "system_u:object_r:bin_t:s0";
        if (fsetxattr(fd, "security.selinux", selinux_value, strlen(selinux_value), 0) == -1) {
            perror("Error setting extended attribute");
            close(fd);
            return 1;
        }

        close(fd);

        return 0;
    }


Affected upstream versions: 5.14
Fixed upstream versions: 0, 6.12.58, 6.17.8, 6.18, 6.6.117
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d2993a7e98eb70c737c6f5365a190e79c72b8407
CVE-2025-68276: avahi: Avahi: Denial of Service via D-Bus record browsers with AVAHI_LOOKUP_USE_WIDE_AREA flag
Component: avahi
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2026-01-12T17:31:49.652000+00:00

A flaw was found in Avahi, a system that facilitates service discovery on a local network. An unprivileged local user can exploit this vulnerability by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can lead to a Denial of Service (DoS) by crashing the avahi-daemon, making the service unavailable.


Affected upstream versions: <= 0.9-rc2
Fixed upstream versions: v0.9-rc3
Upstream repository: https://github.com/avahi/avahi
Upstream fix commit: ede7048475c5d47d53890e3bc1350dda8e0b3688
CVE-2025-68285: kernel: libceph: fix potential use-after-free in have_mon_and_osd_map()
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-16T00:00:00+00:00

A use-after-free vulnerability was found in the Ceph client session initialization in the Linux kernel. The have_mon_and_osd_map() function checks map epochs without holding the appropriate locks, racing with concurrent map updates that free the old map. This can result in dereferencing freed memory during CephFS or RBD mount operations.

Statement: This race condition occurs during Ceph client session establishment. Exploitation is timing-dependent and requires concurrent map updates during mount, making practical exploitation difficult but not impossible.

Affected upstream versions: 2.6.35
Fixed upstream versions: 0, 5.10.247, 5.15.197, 6.1.159, 6.12.61, 6.17.11, 6.18, 6.6.119
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: bb4910c5fd436701faf367e1b5476a5a6d2aff1c
CVE-2025-68287: kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths
Component: kernel
Severity: Important
CWE: CWE-364 (Signal Handler Race Condition)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-16T00:00:00+00:00

A use-after-free vulnerability was found in the DWC3 USB controller driver in the Linux kernel. Multiple unsynchronized execution paths can invoke dwc3_remove_requests() concurrently, leading to premature freeing of USB requests. When one path frees requests while another is still processing them, a use-after-free crash occurs.

Statement: This affects systems with DWC3-based USB controllers, commonly found in ARM SoCs. The race is triggered by USB reset events concurrent with function unbind operations (e.g., during adb root).

Affected upstream versions: 3.2
Fixed upstream versions: 0, 5.10.247, 5.15.197, 6.1.159, 6.12.61, 6.17.11, 6.18, 6.6.119
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 467add9db13219101f14b6cc5477998b4aaa5fe2
CVE-2025-68301: kernel: net: atlantic: fix fragment overflow handling in RX path
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-16T00:00:00+00:00

An out-of-bounds write vulnerability was found in the Aquantia Atlantic network driver in the Linux kernel. When receiving packets that span more than MAX_SKB_FRAGS (17) fragments, the driver writes beyond the skb fragment array bounds in skb_add_rx_frag(), causing kernel memory corruption and panic.

Statement: This affects systems with Aquantia AQC network adapters processing large fragmented packets. Network-adjacent attackers could potentially craft packets to trigger this condition.

Affected upstream versions: 5.10.118 < 5.10.247, 5.15.42 < 5.15.197, 5.17.10 < 5.18, 5.18
Fixed upstream versions: 0, 5.10.247, 5.15.197, 5.18, 6.1.159, 6.12.61, 6.17.11, 6.18, 6.6.119
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 34147477eeab24077fcfe9649e282849347d760c
CVE-2025-68305: kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
Component: kernel
Severity: Moderate
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 7.4 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-16T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel's Bluetooth HCI socket implementation. A race condition between socket bind and write operations allows mgmt_pending to free a command structure while write_iter is still attempting to send it, resulting in use-after-free when the freed memory is accessed.

Statement: This race requires concurrent socket operations from userspace. Local attackers with Bluetooth socket access could potentially trigger this for denial of service or privilege escalation.

Affected upstream versions: 6.6.94 < 6.6.119, 6.12.34 < 6.12.61, 6.15.3 < 6.16, 6.16
Fixed upstream versions: 0, 6.12.61, 6.16, 6.17.11, 6.18, 6.6.119
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fe68510fc99bb4b88c9c611f83699749002d515a
CVE-2025-68347: kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events

The DSP event handling code in hwdep_read() could write more bytes to
the user buffer than requested, when a user provides a buffer smaller
than the event header size (8 bytes).

Fix by using min_t() to clamp the copy size, This ensures we never copy
more than the user requested.


Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.160, 6.12.63, 6.17.13, 6.18.2, 6.19, 6.6.120
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 16620f0617400746984362c3d6ac547eeae1d35f
CVE-2025-68349: kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw null pointer dereference in the Linux kernel NFS functionality was found in the way client does some specific action for existing NFS connection. A client user could use this flaw to crash the server system.

Statement: This bug is caused by a stale state flag (NFS_INO_LAYOUTCOMMIT) remaining set after the pNFS layout has been invalidated, leading to a NULL pointer dereference during layout commit handling. The issue results in a kernel crash when specific NFS writeback paths are executed. As it involves no memory corruption or attacker-controlled data, it represents a denial-of-service condition only.
The issue is triggered by a connected NFS client through normal pNFS writeback flows and affects the NFS server kernel, requiring an established NFSv4 session rather than unauthenticated network access.

Affected upstream versions: 4.10
Fixed upstream versions: 0, 5.10.248, 5.15.198, 6.1.160, 6.12.63, 6.17.13, 6.18.2, 6.19, 6.6.120
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 084bebe82ad86f718a3af84f34761863e63164ed
CVE-2025-68366: kernel: nbd: defer config unlock in nbd_genl_connect
Component: kernel
Severity: Moderate
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nbd: defer config unlock in nbd_genl_connect

There is one use-after-free warning when running NBD_CMD_CONNECT and
NBD_CLEAR_SOCK:

nbd_genl_connect
  nbd_alloc_and_init_config // config_refs=1
  nbd_start_device // config_refs=2
  set NBD_RT_HAS_CONFIG_REF			open nbd // config_refs=3
  recv_work done // config_refs=2
						NBD_CLEAR_SOCK // config_refs=1
						close nbd // config_refs=0
  refcount_inc -> uaf

------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290
 nbd_genl_connect+0x16d0/0x1ab0
 genl_family_rcv_msg_doit+0x1f3/0x310
 genl_rcv_msg+0x44a/0x790

The issue can be easily reproduced by adding a small delay before
refcount_inc(&nbd->config_refs) in nbd_genl_connect():

        mutex_unlock(&nbd->config_lock);
        if (!ret) {
                set_bit(NBD_RT_HAS_CONFIG_REF, &config->runtime_flags);
+               printk("before sleep\n");
+               mdelay(5 * 1000);
+               printk("after sleep\n");
                refcount_inc(&nbd->config_refs);
                nbd_connect_reply(info, nbd->index);
        }


Affected upstream versions: 4.12
Fixed upstream versions: 0, 5.10.248, 5.15.198, 6.1.160, 6.12.63, 6.17.13, 6.18.2, 6.19, 6.6.120
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 330d688a5ca53857828081a3cf31b92ad1b0b3ed
CVE-2025-68428: jspdf: jsPDF Local File Inclusion/Path Traversal vulnerability
Component: jspdf
Severity: Important
CWE: CWE-73 (External Control of File Name or Path)
CVSS v3: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
Public date: 2026-01-05T21:43:55.169000+00:00

A path traversal vulnerability has been discovered in the jdPDF npm library. User control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs. Only the node.js builds of the library are affected, namely the `dist/jspdf.node.js` and `dist/jspdf.node.min.js`.


Affected upstream versions: < 4.0.0
Fixed upstream versions: v4.0.0
Upstream repository: https://github.com/parallax/jsPDF
Upstream fix commit: a688c8f479929b24a6543b1fa2d6364abb03066d
CVE-2025-68468: avahi: Avahi: Denial of Service via crafted mDNS/DNS-SD announcements
Component: avahi
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2026-01-12T17:38:10.492000+00:00

A flaw was found in Avahi. A remote attacker can cause a Denial of Service (DoS) by sending specially crafted unsolicited announcements containing CNAME resource records. These records, when pointing to other resource records with short Time-To-Live (TTL) values, can lead to the `avahi-daemon` crashing once they expire. This vulnerability impacts the availability of services relying on Avahi's service discovery.


Affected upstream versions: <= 0.9-rc2
Fixed upstream versions: v0.9-rc3
Upstream repository: https://github.com/avahi/avahi
Upstream fix commit: f66be13d7f31a3ef806d226bf8b67240179d309a
CVE-2025-68471: avahi: Avahi: Denial of Service via unsolicited CNAME announcements
Component: avahi
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2026-01-12T17:39:57.416000+00:00

A flaw was found in Avahi, a system that enables devices to discover services on a local network using the mDNS/DNS-SD (Multicast Domain Name System/DNS-based Service Discovery) protocols. A remote attacker can exploit this by sending two specific network messages, known as unsolicited announcements with CNAME resource records, within a two-second timeframe. This action can cause the `avahi-daemon` process to crash, leading to a Denial of Service (DoS) for the affected system.


Affected upstream versions: <= 0.9-rc2
Fixed upstream versions: v0.9-rc3
Upstream repository: https://github.com/avahi/avahi
Upstream fix commit: 9c6eb53bf2e290aed84b1f207e3ce35c54cc0aa1
CVE-2025-68476: github.com/kedacore/keda: KEDA: Arbitrary file read vulnerability in Vault authentication
Component: github.com/kedacore/keda
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
Public date: 2025-12-22T21:35:00.480000+00:00

A flaw was found in KEDA, a Kubernetes-based Event Driven Autoscaling component. This arbitrary file read vulnerability allows an attacker with permissions to create or modify a TriggerAuthentication resource to read any file from the node's filesystem where the KEDA pod resides. This is due to insufficient path validation when handling Service Account Tokens during HashiCorp Vault authentication. Successful exploitation can lead to the exfiltration of sensitive system information, such as secrets or configuration files.

Statement: This vulnerability is rated Important because an attacker with permissions to create or modify a KEDA TriggerAuthentication resource can perform arbitrary file reads from the node's filesystem. This impacts Red Hat OpenShift products that utilize KEDA with HashiCorp Vault authentication.

Affected upstream versions: < 2.17.3, >= 2.18.0, < 2.18.3
Fixed upstream versions: v2.19.0
Upstream repository: https://github.com/kedacore/keda
Upstream fix commit: 15c5677f65f809b9b6b59a52f4cf793db0a510fd
CVE-2025-68664: langchain-core: LangChain: Arbitrary code execution via serialization injection
Component: langchain-core
Severity: Critical
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N)
Public date: 2025-12-23T22:47:44.084000+00:00

A flaw was found in LangChain, a framework for building agents and LLM-powered applications. A remote attacker can exploit a serialization injection vulnerability in LangChain's `dumps()` and `dumpd()` functions. This occurs because the functions do not properly escape dictionaries containing the internal 'lc' key during serialization. When user-controlled data includes this key structure, it is incorrectly processed as a legitimate LangChain object during deserialization, potentially leading to arbitrary code execution.

Statement: This vulnerability is rated Critical for Red Hat products. A serialization injection flaw in LangChain's `dumps()` and `dumpd()` functions allows remote attackers to achieve arbitrary code execution. This occurs when user-controlled data containing the internal 'lc' key is improperly deserialized as a legitimate LangChain object.

Affected upstream versions: >= 1.0.0, < 1.2.5, < 0.3.81
Fixed upstream versions: langchain-openrouter==0.0.1
Upstream repository: https://github.com/langchain-ai/langchain
Upstream fix commit: 5ec0fa69de31bbe3d76e4cf9cd65a6accb8466c8
CVE-2025-68665: langchain-core: LangChain: Arbitrary Code Execution via Serialization Injection
Component: langchain-core
Severity: Important
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
Public date: 2025-12-23T22:56:04.837000+00:00

A flaw was found in LangChain. A remote attacker could exploit a serialization injection vulnerability in the `toJSON()` method. This occurs because the method fails to properly escape objects containing 'lc' keys during serialization of free-form data. When user-controlled data includes this key structure, it is incorrectly processed as a legitimate LangChain object during deserialization, which could lead to arbitrary code execution.

Statement: This vulnerability is rated Important for Red Hat products. A serialization injection flaw in LangChain's `toJSON()` method allows a remote attacker to achieve arbitrary code execution. This occurs when user-controlled data containing specific 'lc' key structures is improperly processed as a legitimate LangChain object during deserialization.

Affected upstream versions: @langchain/core >= 1.0.0, < 1.1.8, @langchain/core < 0.3.80, langchain >= 1.0.0, < 1.2.3, langchain < 0.3.37
Fixed upstream versions: @langchain/ibm@0.1.0
Upstream repository: https://github.com/langchain-ai/langchainjs
Upstream fix commit: e5063f9c6e9989ea067dfdff39262b9e7b6aba62
CVE-2025-68724: kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id

Use check_add_overflow() to guard against potential integer overflows
when adding the binary blob lengths and the size of an asymmetric_key_id
structure and return ERR_PTR(-EOVERFLOW) accordingly. This prevents a
possible buffer overflow when copying data from potentially malicious
X.509 certificate fields that can be arbitrarily large, such as ASN.1
INTEGER serial numbers, issuer names, etc.


Affected upstream versions: 3.18
Fixed upstream versions: 0, 5.10.248, 5.15.198, 6.1.160, 6.12.63, 6.17.13, 6.18.2, 6.19, 6.6.120
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 60a7be5ee74408147e439164ac067e418ca74bb4
CVE-2025-68741: kernel: scsi: qla2xxx: Fix improper freeing of purex item
Component: kernel
Severity: Moderate
CWE: CWE-763 (Release of Invalid Pointer or Reference)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix improper freeing of purex item

In qla2xxx_process_purls_iocb(), an item is allocated via
qla27xx_copy_multiple_pkt(), which internally calls
qla24xx_alloc_purex_item().

The qla24xx_alloc_purex_item() function may return a pre-allocated item
from a per-adapter pool for small allocations, instead of dynamically
allocating memory with kzalloc().

An error handling path in qla2xxx_process_purls_iocb() incorrectly uses
kfree() to release the item. If the item was from the pre-allocated
pool, calling kfree() on it is a bug that can lead to memory corruption.

Fix this by using the correct deallocation function,
qla24xx_free_purex_item(), which properly handles both dynamically
allocated and pre-allocated items.


Affected upstream versions: 6.6
Fixed upstream versions: 0, 6.12.63, 6.17.13, 6.18.2, 6.19, 6.6.120
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4bccd506a1f1ab01d1f45b2a3effff6bedc73cf9
CVE-2025-68811: kernel: svcrdma: use rc_pageoff for memcpy byte offset
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.1 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H)
Public date: 2026-01-13T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: use rc_pageoff for memcpy byte offset

svc_rdma_copy_inline_range added rc_curpage (page index) to the page
base instead of the byte offset rc_pageoff. Use rc_pageoff so copies
land within the current page.

Found by ZeroPath (https://zeropath.com)

Statement: This is an out-of-bounds write caused by using a page index (rc_curpage) as a byte offset in memcpy().
A remote NFS/RDMA client can trigger memory corruption or kernel crashes by sending specially crafted inline data.
In the worst case, this breaks the memory safety assumptions of the RDMA receive path and may allow cross-object memory corruption.
Although the issue is remotely triggerable, the attack vector is Adjacent (AV:A), since it requires access to an authorized NFS over RDMA fabric and cannot be exploited from the general Internet. This makes it a storage-network-level vulnerability rather than a public network exposure.

Affected upstream versions: 6.8
Fixed upstream versions: 0, 6.12.64, 6.18.3, 6.19
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e8623e9c451e23d84b870811f42fd872b4089ef6
CVE-2025-68973: GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write
Component: GnuPG
Severity: Important
CWE: CWE-675 (Multiple Operations on Resource in Single-Operation Context)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N)
Public date: 2025-12-28T16:19:11.019000+00:00

A flaw was found in GnuPG. An attacker can provide crafted input to the `armor_filter` function, which incorrectly increments an index variable, leading to an out-of-bounds write. This memory corruption vulnerability may allow for information disclosure and could potentially lead to arbitrary code execution.

Statement: This vulnerability is rated Important for Red Hat products. The flaw in GnuPG's `armor_filter` function allows an attacker with local access to provide crafted input, potentially leading to information disclosure and arbitrary code execution due to an out-of-bounds write. Exploitation requires high attack complexity.

Affected upstream versions: 2.3.0 < 2.4.9
Fixed upstream versions: 2.2.51, 2.4.9
Upstream repository: https://github.com/gpg/gnupg
Upstream fix commit: 115d138ba599328005c5321c0ef9f00355838ca9