CVE-2026-64452 6lowpan: fix NHC entry use-after-free on error path
A race condition in the Linux kernel 6lowpan module allows a use-after-free, potentially causing a system crash or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-64452?
CVE-2026-64452 is a high-severity use after free vulnerability in Linux kernel, published on 25 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
6lowpan: fix NHC entry use-after-free on error path
lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding lowpan_nhc_lock. If the descriptor has no uncompress callback, the error path drops the lock before printing nhc->name.
lowpan_nhc_del() removes descriptors under the same lock and then relies on synchronize_net() before the owning module can be unloaded. That only waits for net RX RCU readers. lowpan_header_decompress() is also exported and can be reached from callers that are not necessarily covered by the net core RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive path.
This leaves a race where one task drops lowpan_nhc_lock in the error path, another task unregisters and frees the matching descriptor after synchronize_net() returns, and the first task then dereferences nhc->name for the warning.
With the post-unlock window widened, KASAN reports:
BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220 Read of size 8 lowpan_nhc_do_uncompression lowpan_header_decompress
Fix this by printing the warning before dropping lowpan_nhc_lock, so the descriptor name is read while unregister is still excluded. The malformed packet is still rejected with -ENOTSUPP.
Weakness: CWE-416
Which versions are affected by CVE-2026-64452?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64452?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-64452 being exploited?
There is no known exploitation of CVE-2026-64452 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-93926, BELL-CVE-2026-64452, DEBIAN-CVE-2026-64452, GHSA-c2hf-fh99-25vq, ROOT-OS-DEBIAN-12-CVE-2026-64452, ROOT-OS-UBUNTU-2204-CVE-2026-64452 and 1 more.