CVE-2026-72337

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: 6lowpan: avoid untracked enable work

lowpan_enable_set() allocates a temporary work item and schedules

do_enable_set() on system_wq, then returns to debugfs. The debugfs active

operation has ended at that point, but the worker still executes module

text and manipulates enable_6lowpan and listen_chan.

bt_6lowpan_exit() removes the debugfs files and immediately closes and

puts listen_chan. It has no pointer to the queued work item, so it cannot

cancel or flush it before tearing down the state that the worker uses.

The buggy scenario involves two paths, with each column showing the order

within that path:

debugfs enable write module exit

1. lowpan_enable_set() allocates 1. bt_6lowpan_exit() removes

set_enable work the debugfs file

2. schedule_work() queues 2. bt_6lowpan_exit() closes

do_enable_set() and puts listen_chan

3. the write operation

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References