PT-2026-64673 · Linux · Linux
CVE-2026-64452
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
6lowpan: fix NHC entry use-after-free on error path
lowpan nhc do uncompression() looks up an NHC descriptor while holding
lowpan nhc lock. If the descriptor has no uncompress callback, the error
path drops the lock before printing nhc->name.
lowpan nhc del() removes descriptors under the same lock and then relies
on synchronize net() before the owning module can be unloaded. That only
waits for net RX RCU readers. lowpan header decompress() is also exported
and can be reached from callers that are not necessarily covered by the net
core RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive
path.
This leaves a race where one task drops lowpan nhc lock in the error path,
another task unregisters and frees the matching descriptor after
synchronize net() returns, and the first task then dereferences nhc->name
for the warning.
With the post-unlock window widened, KASAN reports:
BUG: KASAN: slab-use-after-free in lowpan nhc do uncompression+0x1f4/0x220
Read of size 8
lowpan nhc do uncompression
lowpan header decompress
Fix this by printing the warning before dropping lowpan nhc lock, so the
descriptor name is read while unregister is still excluded. The malformed
packet is still rejected with -ENOTSUPP.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux