CVE-2026-64452 - Vulnerability Details

- 6lowpan: fix NHC entry use-after-free on error path

Description

In the Linux kernel, the following vulnerability has been resolved:

6lowpan: fix NHC entry use-after-free on error path

lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding
lowpan_nhc_lock. If the descriptor has no uncompress callback, the error
path drops the lock before printing nhc->name.

lowpan_nhc_del() removes descriptors under the same lock and then relies
on synchronize_net() before the owning module can be unloaded. That only
waits for net RX RCU readers. lowpan_header_decompress() is also exported
and can be reached from callers that are not necessarily covered by the net
core RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive
path.

This leaves a race where one task drops lowpan_nhc_lock in the error path,
another task unregisters and frees the matching descriptor after
synchronize_net() returns, and the first task then dereferences nhc->name
for the warning.

With the post-unlock window widened, KASAN reports:

BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220
Read of size 8
lowpan_nhc_do_uncompression
lowpan_header_decompress

Fix this by printing the warning before dropping lowpan_nhc_lock, so the
descriptor name is read while unregister is still excluded. The malformed
packet is still rejected with -ENOTSUPP.

Published: 2026-07-25

Score: 7.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

During the handling of malformed 6LoWPAN packets, the kernel removes a Network Header Compression (NHC) descriptor and immediately afterward dereferences its name field while still holding the lock. This use‑after‑free triggers a KASAN error and results in a kernel oops.

Affected Systems

All Linux kernel implementations that include the 6LoWPAN NHC subsystem and have not incorporated the commit that prints the warning before releasing the lock are affected. Because the vulnerability resides in the core Linux kernel, any distribution version that has not applied the patch could be vulnerable. Any system exposing a 6LoWPAN interface is therefore at risk until the patch is applied.

Risk and Exploitability

The CVSS score of 7.1 reflects a high severity due to loss of memory integrity, yet the EPSS score is below 1 %, indicating a very low likelihood of exploitation at present. The vulnerability is not listed in CISA KEV, and no public exploits are known. Exploitation requires the injection of malformed 6LoWPAN traffic plus a race condition between the error path and module unloading; thus the attack surface is narrow but potentially available to remote actors who can send packets to the target device. While a crash does not directly grant code execution, it can disrupt availability and may be leveraged in a broader attack if combined with additional flaws.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`92aa7c65d295f3cbb96904afe335f683e55584b8`	affected	< 9c2f5c0829a8c8b904dae36be6d8056b719ac605
`92aa7c65d295f3cbb96904afe335f683e55584b8`	affected	< 80b5c8779acee0550845394fb3e5176a398aa24c
`92aa7c65d295f3cbb96904afe335f683e55584b8`	affected	< cc27aea4d454abfb385ee2c9499c78b96db9b728
`92aa7c65d295f3cbb96904afe335f683e55584b8`	affected	< a8e3a94711134e898c6021a6b77374efa91b3639
`92aa7c65d295f3cbb96904afe335f683e55584b8`	affected	< 593b78bb3c7ef0c6e9ae6fdf5afa80a5f7573168
`92aa7c65d295f3cbb96904afe335f683e55584b8`	affected	< 0beccbcf50de125be5520d0ffc59af4bb8655482
`92aa7c65d295f3cbb96904afe335f683e55584b8`	affected	< b713aa0cc344f10f7a9928a230b5f5e780d04078
`92aa7c65d295f3cbb96904afe335f683e55584b8`	affected	< 1720db928e5a58ca7d75ac1d514c3b73fd7061a7

Linux

affected

Version	Status	Constraints
`4.1`	affected	—
`0`	unaffected	< 4.1
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[92aa7c65d295f3cbb96904afe335f683e55584b8,9c2f5c0829a8c8b904dae36be6d8056b719ac605)`	affected	code_commit	—
`[92aa7c65d295f3cbb96904afe335f683e55584b8,80b5c8779acee0550845394fb3e5176a398aa24c)`	affected	code_commit	—
`[92aa7c65d295f3cbb96904afe335f683e55584b8,cc27aea4d454abfb385ee2c9499c78b96db9b728)`	affected	code_commit	—
`[92aa7c65d295f3cbb96904afe335f683e55584b8,a8e3a94711134e898c6021a6b77374efa91b3639)`	affected	code_commit	—
`[92aa7c65d295f3cbb96904afe335f683e55584b8,593b78bb3c7ef0c6e9ae6fdf5afa80a5f7573168)`	affected	code_commit	—
`[92aa7c65d295f3cbb96904afe335f683e55584b8,0beccbcf50de125be5520d0ffc59af4bb8655482)`	affected	code_commit	—
`[92aa7c65d295f3cbb96904afe335f683e55584b8,b713aa0cc344f10f7a9928a230b5f5e780d04078)`	affected	code_commit	—
`[92aa7c65d295f3cbb96904afe335f683e55584b8,1720db928e5a58ca7d75ac1d514c3b73fd7061a7)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.1`	affected	generic	—
`[0,4.1)`	unaffected	generic	—
`[5.10.261,5.10.*]`	unaffected	generic	—
`[5.15.212,5.15.*]`	unaffected	generic	—
`[6.1.178,6.1.*]`	unaffected	generic	—
`[6.6.145,6.6.*]`	unaffected	generic	—
`[6.12.96,6.12.*]`	unaffected	generic	—
`[6.18.39,6.18.*]`	unaffected	generic	—
`[7.1.4,7.1.*]`	unaffected	generic	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel update that includes the commit fixing the NHC use‑after‑free.
Reboot the system to load the patched kernel and ensure the module is loaded.
If 6LoWPAN is not required, unload or disable the 6LoWPAN module to eliminate the vulnerable code path.

Generated by OpenCVE AI on August 4, 2026 at 14:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00219.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0beccbcf50de125be5520d0ffc59af4bb8655482
https://git.kernel.org/stable/c/1720db928e5a58ca7d75ac1d514c3b73fd7061a7
https://git.kernel.org/stable/c/593b78bb3c7ef0c6e9ae6fdf5afa80a5f7573168
https://git.kernel.org/stable/c/80b5c8779acee0550845394fb3e5176a398aa24c
https://git.kernel.org/stable/c/9c2f5c0829a8c8b904dae36be6d8056b719ac605
https://git.kernel.org/stable/c/a8e3a94711134e898c6021a6b77374efa91b3639
https://git.kernel.org/stable/c/b713aa0cc344f10f7a9928a230b5f5e780d04078
https://git.kernel.org/stable/c/cc27aea4d454abfb385ee2c9499c78b96db9b728
https://lore.kernel.org/linux-cve-announce/2026072541-CVE-2026-64452-5498@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64452
https://www.cve.org/CVERecord?id=CVE-2026-64452

History

Tue, 28 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026072541-CVE-2026-64452-5498@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64452 https://www.cve.org/CVERecord?id=CVE-2026-64452
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 27 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}`

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding lowpan_nhc_lock. If the descriptor has no uncompress callback, the error path drops the lock before printing nhc->name. lowpan_nhc_del() removes descriptors under the same lock and then relies on synchronize_net() before the owning module can be unloaded. That only waits for net RX RCU readers. lowpan_header_decompress() is also exported and can be reached from callers that are not necessarily covered by the net core RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive path. This leaves a race where one task drops lowpan_nhc_lock in the error path, another task unregisters and frees the matching descriptor after synchronize_net() returns, and the first task then dereferences nhc->name for the warning. With the post-unlock window widened, KASAN reports: BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220 Read of size 8 lowpan_nhc_do_uncompression lowpan_header_decompress Fix this by printing the warning before dropping lowpan_nhc_lock, so the descriptor name is read while unregister is still excluded. The malformed packet is still rejected with -ENOTSUPP.
Title		6lowpan: fix NHC entry use-after-free on error path
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0beccbcf50de125be5520d0ffc59af4bb8655482 https://git.kernel.org/stable/c/1720db928e5a58ca7d75ac1d514c3b73fd7061a7 https://git.kernel.org/stable/c/593b78bb3c7ef0c6e9ae6fdf5afa80a5f7573168 https://git.kernel.org/stable/c/80b5c8779acee0550845394fb3e5176a398aa24c https://git.kernel.org/stable/c/9c2f5c0829a8c8b904dae36be6d8056b719ac605 https://git.kernel.org/stable/c/a8e3a94711134e898c6021a6b77374efa91b3639 https://git.kernel.org/stable/c/b713aa0cc344f10f7a9928a230b5f5e780d04078 https://git.kernel.org/stable/c/cc27aea4d454abfb385ee2c9499c78b96db9b728

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:51:21.754Z

Updated: 2026-08-05T12:42:15.095Z

Reserved: 2026-07-19T15:36:31.788Z

Link: CVE-2026-64452

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-07-25T10:17:30.140

Modified: 2026-08-11T15:01:50.637

Link: CVE-2026-64452

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64452 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-04T14:30:10Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object