PT-2026-64673 · Linux · Linux
CVE-2026-64452
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
6lowpan: fix NHC entry use-after-free on error path
lowpan nhc do uncompression() looks up an NHC descriptor while holding
lowpan nhc lock. If the descriptor has no uncompress callback, the error
path drops the lock before printing nhc->name.
lowpan nhc del() removes descriptors under the same lock and then relies
on synchronize net() before the owning module can be unloaded. That only
waits for net RX RCU readers. lowpan header decompress() is also exported
and can be reached from callers that are not necessarily covered by the net
core RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive
path.
This leaves a race where one task drops lowpan nhc lock in the error path,
another task unregisters and frees the matching descriptor after
synchronize net() returns, and the first task then dereferences nhc->name
for the warning.
With the post-unlock window widened, KASAN reports:
BUG: KASAN: slab-use-after-free in lowpan nhc do uncompression+0x1f4/0x220
Read of size 8
lowpan nhc do uncompression
lowpan header decompress
Fix this by printing the warning before dropping lowpan nhc lock, so the
descriptor name is read while unregister is still excluded. The malformed
packet is still rejected with -ENOTSUPP.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux