CVE-2026-64452

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel 6LoWPAN NHC Decompression

Publication date: 2026-07-25

Last updated on: 2026-09-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding lowpan_nhc_lock. If the descriptor has no uncompress callback, the error path drops the lock before printing nhc->name. lowpan_nhc_del() removes descriptors under the same lock and then relies on synchronize_net() before the owning module can be unloaded. That only waits for net RX RCU readers. lowpan_header_decompress() is also exported and can be reached from callers that are not necessarily covered by the net core RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive path. This leaves a race where one task drops lowpan_nhc_lock in the error path, another task unregisters and frees the matching descriptor after synchronize_net() returns, and the first task then dereferences nhc->name for the warning. With the post-unlock window widened, KASAN reports: BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220 Read of size 8 lowpan_nhc_do_uncompression lowpan_header_decompress Fix this by printing the warning before dropping lowpan_nhc_lock, so the descriptor name is read while unregister is still excluded. The malformed packet is still rejected with -ENOTSUPP.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-03

Generated

2026-09-24

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64452

EUVD

EUVD-2026-48796

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.11 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 4.1 (inc) to 5.10.261 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's 6lowpan subsystem. It occurs when an error path in lowpan_nhc_do_uncompression() tries to access a freed NHC descriptor's name after dropping a lock. The issue arises because the descriptor can be unregistered and freed while another task still holds a reference to it.

Detection Guidance

This vulnerability is specific to the Linux kernel's 6lowpan subsystem and may not have direct detection commands. Monitor kernel logs for slab-use-after-free errors related to lowpan_nhc_do_uncompression or lowpan_header_decompress. Check for crashes or warnings in Bluetooth 6LoWPAN L2CAP receive paths.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service (system crash) or potentially execute arbitrary code with kernel privileges. It affects systems using 6LoWPAN networking, particularly those with Bluetooth 6LoWPAN L2CAP support.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's 6lowpan component, which could lead to memory corruption or crashes. It does not directly impact data privacy or security controls required by standards like GDPR or HIPAA. However, if exploited, it might cause system instability or denial-of-service conditions, potentially affecting the availability of systems handling sensitive data.

Mitigation Strategies

Update the Linux kernel to the patched version that resolves this issue. If immediate patching is not possible, disable the 6lowpan module or Bluetooth 6LoWPAN functionality as a temporary workaround to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-64452. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70