CVE-2026-64452
Status: AnalyzedHigh (7.1)—
In the Linux kernel, the following vulnerability has been resolved:
6lowpan: fix NHC entry use-after-free on error path
lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding lowpan_nhc_lock. If the descriptor has no uncompress callback, the error path drops the lock before printing nhc->name.
lowpan_nhc_del() removes descriptors under the same lock and then relies on synchronize_net() before the owning module can be unloaded. That only waits for net RX RCU readers. lowpan_header_decompress() is also exported and can be reached from callers that are not necessarily covered by the net core RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive path.
Read full descriptionShow less
This leaves a race where one task drops lowpan_nhc_lock in the error path, another task unregisters and frees the matching descriptor after synchronize_net() returns, and the first task then dereferences nhc->name for the warning.
With the post-unlock window widened, KASAN reports:
Fix this by printing the warning before dropping lowpan_nhc_lock, so the descriptor name is read while unregister is still excluded. The malformed packet is still rejected with -ENOTSUPP.
Technical details traces, logs and code from the original report
BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220 Read of size 8 lowpan_nhc_do_uncompression lowpan_header_decompress
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Base score: 7.1
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.22%
- Percentile among all scored CVEs: 11
- Score date: 10/5/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
🎯 ATT&CK techniques
How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.
- Exploitation
T1203Exploitation for Client Executionexecution75 % - Primary impact
T1068Exploitation for Privilege Escalationprivilege escalation70 %
Vulnerabilidad de use-after-free (CWE-416) en kernel Linux que requiere un paquete malformado (interacción del usuario) en red adyacente (AV:A, UI:R). Permite escalada de privilegios vía denegación de servicio o corrupción de memoria.
Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.
🛡️ ATT&CK mitigations that cover these techniques
Affected technologies (1)
CWEs
- CWE-416
References
- https://git.kernel.org/stable/c/0beccbcf50de125be5520d0ffc59af4bb8655482
- https://git.kernel.org/stable/c/1720db928e5a58ca7d75ac1d514c3b73fd7061a7
- https://git.kernel.org/stable/c/593b78bb3c7ef0c6e9ae6fdf5afa80a5f7573168
- https://git.kernel.org/stable/c/80b5c8779acee0550845394fb3e5176a398aa24c
- https://git.kernel.org/stable/c/9c2f5c0829a8c8b904dae36be6d8056b719ac605
- https://git.kernel.org/stable/c/a8e3a94711134e898c6021a6b77374efa91b3639
- https://git.kernel.org/stable/c/b713aa0cc344f10f7a9928a230b5f5e780d04078
- https://git.kernel.org/stable/c/cc27aea4d454abfb385ee2c9499c78b96db9b728
Raw JSON (NVD)
Show
{
"id": "CVE-2026-64452",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.1,
"attackVector": "ADJACENT_NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "HIGH",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.2
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
"lessThan": "9c2f5c0829a8c8b904dae36be6d8056b719ac605",
"versionType": "git"
},
{
"status": "affected",
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
"lessThan": "80b5c8779acee0550845394fb3e5176a398aa24c",
"versionType": "git"
},
{
"status": "affected",
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
"lessThan": "cc27aea4d454abfb385ee2c9499c78b96db9b728",
"versionType": "git"
},
{
"status": "affected",
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
"lessThan": "a8e3a94711134e898c6021a6b77374efa91b3639",
"versionType": "git"
},
{
"status": "affected",
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
"lessThan": "593b78bb3c7ef0c6e9ae6fdf5afa80a5f7573168",
"versionType": "git"
},
{
"status": "affected",
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
"lessThan": "0beccbcf50de125be5520d0ffc59af4bb8655482",
"versionType": "git"
},
{
"status": "affected",
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
"lessThan": "b713aa0cc344f10f7a9928a230b5f5e780d04078",
"versionType": "git"
},
{
"status": "affected",
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
"lessThan": "1720db928e5a58ca7d75ac1d514c3b73fd7061a7",
"versionType": "git"
}
],
"programFiles": [
"net/6lowpan/nhc.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/6lowpan/nhc.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-07-25T10:17:30.140",
"references": [
{
"url": "https://git.kernel.org/stable/c/0beccbcf50de125be5520d0ffc59af4bb8655482",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1720db928e5a58ca7d75ac1d514c3b73fd7061a7",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/593b78bb3c7ef0c6e9ae6fdf5afa80a5f7573168",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/80b5c8779acee0550845394fb3e5176a398aa24c",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9c2f5c0829a8c8b904dae36be6d8056b719ac605",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a8e3a94711134e898c6021a6b77374efa91b3639",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b713aa0cc344f10f7a9928a230b5f5e780d04078",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cc27aea4d454abfb385ee2c9499c78b96db9b728",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\n6lowpan: fix NHC entry use-after-free on error path\n\nlowpan_nhc_do_uncompression() looks up an NHC descriptor while holding\nlowpan_nhc_lock. If the descriptor has no uncompress callback, the error\npath drops the lock before printing nhc->name.\n\nlowpan_nhc_del() removes descriptors under the same lock and then relies\non synchronize_net() before the owning module can be unloaded. That only\nwaits for net RX RCU readers. lowpan_header_decompress() is also exported\nand can be reached from callers that are not necessarily covered by the net\ncore RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive\npath.\n\nThis leaves a race where one task drops lowpan_nhc_lock in the error path,\nanother task unregisters and frees the matching descriptor after\nsynchronize_net() returns, and the first task then dereferences nhc->name\nfor the warning.\n\nWith the post-unlock window widened, KASAN reports:\n\n BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220\n Read of size 8\n lowpan_nhc_do_uncompression\n lowpan_header_decompress\n\nFix this by printing the warning before dropping lowpan_nhc_lock, so the\ndescriptor name is read while unregister is still excluded. The malformed\npacket is still rejected with -ENOTSUPP."
}
],
"lastModified": "2026-09-03T15:25:07.700",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2C338AC7-51C3-43D3-8E70-66343021315C",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.1"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8E99FB01-CD93-41AF-A653-3F450652B9A6",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.7"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.13"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.19"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}