CVE-2026-64452

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

6lowpan: fix NHC entry use-after-free on error path

lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding

lowpan_nhc_lock. If the descriptor has no uncompress callback, the error

path drops the lock before printing nhc->name.

lowpan_nhc_del() removes descriptors under the same lock and then relies

on synchronize_net() before the owning module can be unloaded. That only

waits for net RX RCU readers. lowpan_header_decompress() is also exported

and can be reached from callers that are not necessarily covered by the net

core RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive

path.

This leaves a race where one task drops lowpan_nhc_lock in the error path,

another task unregisters and frees the matching descriptor after

synchronize_net() returns, and the first task then dereferences nhc->name

for the warning.

With the post-unlock window widened, KASAN reports:

BUG: KASAN: slab-us

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References