CVE-2026-64452

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the 6lowpan implementation. The function lowpan nhc do uncompression() retrieves an NHC descriptor while holding the lowpan nhc lock. If the descriptor lacks an uncompress callback, the error path releases the lock before accessing nhc->name. Simultaneously, lowpan nhc del() can remove and free descriptors under the same lock. Because lowpan header decompress() can be called from paths not covered by the net core RX critical section, such as the Bluetooth 6LoWPAN L2CAP receive path, a race condition occurs. This allows a task to dereference nhc->name after the descriptor has been freed, leading to a slab-use-after-free. The issue is triggered within the lowpan nhc do uncompression() and lowpan header decompress() functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.