CVE-2026-72337

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the Bluetooth 6LoWPAN implementation. The function lowpan enable set() allocates a temporary work item and schedules do enable set() on the system workqueue (system wq) before returning to debugfs. Because bt 6lowpan exit() removes debugfs files and closes listen chan without a reference to the queued work item, it cannot cancel or flush the work before tearing down the state. This allows do enable set() to execute against stale state, leading to a slab-use-after-free (a situation where the system attempts to access memory after it has been freed). The issue involves the manipulation of the enable 6lowpan and listen chan variables.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.