The 6LoWPAN NHC subsystem contains a race that permits a use‑after‑free. When an invalid packet is received, the code releases lowpan_nhc_lock and then later reads the descriptor’s name field. A second task may simultaneously unregister and free that descriptor after synchronize_net returns, so the lock is held no longer during the read. The freed memory is dereferenced, triggering a slab-use‑after‑free crash in the kernel and leading to a kernel oops. This results in memory corruption and a denial‑of‑service condition but does not directly provide code execution.

All Linux kernel implementations that include the 6LoWPAN NHC subsystem and have not incorporated the commit that prints the warning before releasing the lock are affected. Because the vulnerability resides in the core Linux kernel, any distribution version lacking the patch could be vulnerable. Any system that exposes a 6LoWPAN interface is therefore at risk until the patch is applied.

The CVSS score of 7.1 reflects a high severity due to loss of memory integrity, yet the EPSS score is below 1 %, indicating a very low likelihood of exploitation at present. Based on the description, it is inferred that the attack vector involves remote actors injecting malformed 6LoWPAN packets to trigger the use‑after‑free race. The vulnerability is not listed in CISA KEV, and no public exploits are known. Exploitation requires the injection of malformed 6LoWPAN traffic combined with a race condition between the error path that releases the lock and the module unload that frees the descriptor; thus the attack surface is narrow but available to remote actors who can send packets to the target device. While a crash does not directly grant code execution, it can disrupt availability and may be leveraged in a broader attack if combined with additional flaws.