PT-2026-94506

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock occurs in the m68k nfcon component. The show cons active function calls the .device method while holding the console list lock. Because the nfcon device function subsequently...

PT-2026-94916

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the usb gadget configfs component. The function os desc qw sign show incorrectly uses OS STRING QW SIGN LEN as the input length for utf16s to utf8s. Becau...

PT-2026-94740

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists when reading bpf link information. In the functions bpf link show fdinfo and bpf link get info by fd, the link-prog variable is accessed without proper...

PT-2026-94651

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the show pte function when CONFIG DEBUG USER=y and the user debug=31 command line option is enabled. This occurs because a user fault can trigger show pt...

CVE-2026-90022 usb: gadget: f_midi2: fix use-after-free in string attribute show path

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi2: fix use-after-free in string attribute show path fmidi2optsstrshow takes the string lock internally, but its callers dereference the opts-info. pointer before calling it, outside the lock. This races with...

PT-2026-93655

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free crash can occur in the tracing subsystem. The files show event filters and show event triggers do not take a reference to the trace array they are displaying...

PT-2026-93495

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the scsi qla2xxx driver. The function qla84xx put chip releases the reference to ha-cs84xx and frees it via qla84xx chip release without clearing the...

CVE-2026-51134

The C-MOR Video Surveillance web interface up to version 6.0104 is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml...

CVE-2026-51134: Improper Limitation of a Pathname to a Restricted Directory

The C-MOR Video Surveillance web interface up to version 6.0104 is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml...

PT-2026-92419

The C-MOR Video Surveillance web interface up to version 6.0104 is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml...

EUVD-2026-79997

The C-MOR Video Surveillance web interface up to version 6.0104 is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml...

CVE-2026-51134

The C-MOR Video Surveillance web interface up to version 6.0104 is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml...

CVE-2026-51134

The C-MOR Video Surveillance web interface (up to version 6.0104 ) by za-internet GmbH is vulnerable to a Path Traversal vulnerability. An unauthenticated attacker can access arbitrary system files by sending specially crafted HTTP requests to the show-movies.pml component, specifically by using ...

CVE-2026-51134

The C-MOR Video Surveillance web interface up to version 6.0104 is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix access violation during port device removal Testing with KASAN and syzkaller revealed a bug in the port.c:disablestore function. The usbhubtostructhub function may return NULL if the hub to which the port belongs i...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcmloop: Fixed a segfault in tcmlooptpgaddressshow If the allocation of tlhba-sh fails in tcmloopdriverprobe, and we attempt to dereference it in tcmlooptpgaddressshow, we will encounter a segfault. See below for an...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fixed a potential Use-after-Allocation UAF in cifsstatsprocshow. Skipped sessions that are being terminated status == SESEXITING to avoid UAF...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: fixed a use-after-free in stateshow stateshow reads kdamond-damonctx without holding damonsysfslock. This allows for a use-after-free race condition: CPU 0 CPU 1 ----- ----- stateshow damonsysfsturndamonon ctx =...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ftrace: Avoid potential division by zero in the functionstatshow function. Check whether the denominator expression x x - 1 1000 mod 2^32, 2^64 results in zero, and skip the calculation of stddev in such cases. For now, don’t wor...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: leds: class: Protect access to brightnessshow using ledcdev-ledaccess mutex There is a NULL pointer issue observed when Process A adds a hid device, resulting in the addition of a ledcdev object. Subsequently, another call to...