CVE-2026-72337

Received Received - Intake

Race Condition in Linux Kernel Bluetooth 6LoWPAN Module

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpan_enable_set() allocates a temporary work item and schedules do_enable_set() on system_wq, then returns to debugfs. The debugfs active operation has ended at that point, but the worker still executes module text and manipulates enable_6lowpan and listen_chan. bt_6lowpan_exit() removes the debugfs files and immediately closes and puts listen_chan. It has no pointer to the queued work item, so it cannot cancel or flush it before tearing down the state that the worker uses. The buggy scenario involves two paths, with each column showing the order within that path: debugfs enable write module exit 1. lowpan_enable_set() allocates 1. bt_6lowpan_exit() removes set_enable work the debugfs file 2. schedule_work() queues 2. bt_6lowpan_exit() closes do_enable_set() and puts listen_chan 3. the write operation returns 3. module teardown can continue 4. do_enable_set() later runs against stale state Run the enable state transition synchronously in lowpan_enable_set() instead. The simple debugfs setter can sleep, and this file already handles the 6LoWPAN control write synchronously under the same set_lock. Once the setter returns, debugfs removal covers the whole operation and exit can no longer race with an untracked work item. Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in do_enable_set+0x113/0x2e0 Workqueue: events do_enable_set [bluetooth_6lowpan] The buggy address belongs to the object at ffff888109cb8000

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72337

EUVD

EUVD-2026-59236

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's Bluetooth 6LoWPAN subsystem. It occurs when the kernel schedules a work item to enable 6LoWPAN but the module exits before the work completes. The debugfs operation ends while the worker still manipulates freed memory, causing a slab-use-after-free error.

Detection Guidance

This vulnerability may manifest as a slab-use-after-free error in the kernel logs, specifically involving do_enable_set in the bluetooth_6lowpan module. Check kernel logs for KASAN errors or crashes related to this module using commands like dmesg | grep -i kasan or journalctl -k | grep -i slab-use-after-free.

Impact Analysis

This vulnerability could lead to kernel crashes or arbitrary code execution. An attacker with local access might exploit it to gain elevated privileges or cause denial-of-service conditions on affected systems.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a kernel-level issue related to Bluetooth 6lowpan functionality. Compliance impacts would depend on system-specific configurations and data handling practices rather than this technical flaw.

Mitigation Strategies

Apply the latest kernel security patches that address this issue. If immediate patching is not possible, consider disabling the 6lowpan Bluetooth feature by unloading the bluetooth_6lowpan module using rmmod bluetooth_6lowpan until the patch is applied.

Hi! I’m here to help you understand CVE-2026-72337. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70