CVE-2025-39729
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix dereferencing uninitialized error pointer Fix below
CVSS
5.5
Medium
EPSS
0.1%
p4
KEV
—
Exploit Today
1
0-100
Published: Sep 7, 2025 · Last modified: Oct 19, 2026 · CWE-824
0.1%EPSS · 30 days0.1%
2026-09-302026-10-28
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix dereferencing uninitialized error pointer Fix below smatch warnings: drivers/crypto/ccp/sev-dev.c:1312 __sev_platform_init_locked() error: we previously assumed 'error' could be null
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1153275.3 MED23.4%
——7libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the heap.15hCVE-2026-1096198.1 HIG100.0%
KEV—80PHP Stale Internal Request-State Vulnerability2dCVE-2026-1096189.8 CRI100.0%
KEV—80PHP Memory Corruption Vulnerability1hCVE-2026-94018—33.6%
——10The Web add-on's HTTP server dereferences and releases an uninitialized pointer when it detects a `Content-Length` underflow while processing a `PUT` request. The condition is reachable by an unauthenticated remote client with a single malformed request.9dCVE-2026-868476.5 MED8.2%
——2A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash.10dCVE-2026-1106036.3 MED6.5%
——2LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count that, when opened and destroyed through the C API, crashes the process and corrupts the heap.13d