In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path… (CVE-2026-64452)
In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding lowpan_nhc_lock. If the descriptor has no uncompress callback, the error path drops the lock before printing nhc->name. lowpan_nhc_del() removes descriptors under the same lock and then relies on synchronize_net() before the owning module can be unloaded. That only waits for net RX RCU readers. lowpan_header_decompress() is also exported and can be reached from callers that are not necessarily covered by the net core RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive path. This leaves a race where one task drops lowpan_nhc_lock in the error path, another task unregisters and frees the matching descriptor after synchronize_net() returns, and the first task then dereferences nhc->name for the warning. With the post-unlock window widened, KASAN reports: BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220 Read of size 8 lowpan_nhc_do_uncompression lowpan_header_decompress Fix this by printing the warning before dropping lowpan_nhc_lock, so the descriptor name is read while unregister is still excluded. The malformed packet is still rejected with -ENOTSUPP.
AI Analysis
Technical Summary
The Linux kernel's 6LoWPAN code had a use-after-free vulnerability (CVE-2026-64452) in the lowpan_nhc_do_uncompression() function. The function looks up an NHC descriptor while holding a lock, but on an error path, it releases the lock before printing the descriptor's name. Meanwhile, another task could unregister and free the descriptor after synchronize_net() returns, leading to a race condition where the first task dereferences freed memory. The vulnerability was fixed by changing the code to print the warning while still holding the lock, preventing use-after-free access.
Potential Impact
This vulnerability can cause a use-after-free memory access in the kernel, which may lead to kernel crashes or undefined behavior. There is no indication of remote code execution or privilege escalation in the provided data. The malformed packet causing the error is rejected, limiting impact to denial of service or system instability.
Mitigation Recommendations
A fix is available and has been applied in the Linux kernel to address this use-after-free vulnerability by reordering operations to maintain locking during descriptor name access. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the provided data; check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply them promptly.
In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path… (CVE-2026-64452)
Description
In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding lowpan_nhc_lock. If the descriptor has no uncompress callback, the error path drops the lock before printing nhc->name. lowpan_nhc_del() removes descriptors under the same lock and then relies on synchronize_net() before the owning module can be unloaded. That only waits for net RX RCU readers. lowpan_header_decompress() is also exported and can be reached from callers that are not necessarily covered by the net core RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive path. This leaves a race where one task drops lowpan_nhc_lock in the error path, another task unregisters and frees the matching descriptor after synchronize_net() returns, and the first task then dereferences nhc->name for the warning. With the post-unlock window widened, KASAN reports: BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220 Read of size 8 lowpan_nhc_do_uncompression lowpan_header_decompress Fix this by printing the warning before dropping lowpan_nhc_lock, so the descriptor name is read while unregister is still excluded. The malformed packet is still rejected with -ENOTSUPP.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's 6LoWPAN code had a use-after-free vulnerability (CVE-2026-64452) in the lowpan_nhc_do_uncompression() function. The function looks up an NHC descriptor while holding a lock, but on an error path, it releases the lock before printing the descriptor's name. Meanwhile, another task could unregister and free the descriptor after synchronize_net() returns, leading to a race condition where the first task dereferences freed memory. The vulnerability was fixed by changing the code to print the warning while still holding the lock, preventing use-after-free access.
Potential Impact
This vulnerability can cause a use-after-free memory access in the kernel, which may lead to kernel crashes or undefined behavior. There is no indication of remote code execution or privilege escalation in the provided data. The malformed packet causing the error is rejected, limiting impact to denial of service or system instability.
Mitigation Recommendations
A fix is available and has been applied in the Linux kernel to address this use-after-free vulnerability by reordering operations to maintain locking during descriptor name access. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the provided data; check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply them promptly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-c2hf-fh99-25vq
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64452"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a6542089c2644c7f8082fb2
Added to database: 07/25/2026, 23:08:56 UTC
Last enriched: 07/25/2026, 23:20:37 UTC
Last updated: 09/07/2026, 10:52:10 UTC
Views: 72
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.