# CVE-2026-72337: Bluetooth: 6lowpan: avoid untracked enable work

> A race condition in the Linux kernel Bluetooth 6LoWPAN module allows local attackers to trigger a use-after-free, potentially leading to code execution or privilege escalation.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** An administrator
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 15 Aug 2026
- **Updated:** 21 Oct 2026
- **Also known as:** AZL-96453, BELL-CVE-2026-72337, DEBIAN-CVE-2026-72337, GHSA-f7wf-gfq3-cm8r, UBUNTU-CVE-2026-72337

## What is CVE-2026-72337?

CVE-2026-72337 is an use after free vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: 6lowpan: avoid untracked enable work

lowpan_enable_set() allocates a temporary work item and schedules
do_enable_set() on system_wq, then returns to debugfs. The debugfs active
operation has ended at that point, but the worker still executes module
text and manipulates enable_6lowpan and listen_chan.

bt_6lowpan_exit() removes the debugfs files and immediately closes and
puts listen_chan. It has no pointer to the queued work item, so it cannot
cancel or flush it before tearing down the state that the worker uses.

The buggy scenario involves two paths, with each column showing the order
within that path:

debugfs enable write              module exit
1. lowpan_enable_set() allocates  1. bt_6lowpan_exit() removes
   set_enable work                   the debugfs file
2. schedule_work() queues         2. bt_6lowpan_exit() closes
   do_enable_set()                   and puts listen_chan
3. the write operation returns    3. module teardown can continue
4. do_enable_set() later runs
   against stale state

Run the enable state transition synchronously in lowpan_enable_set()
instead. The simple debugfs setter can sleep, and this file already handles
the 6LoWPAN control write synchronously under the same set_lock. Once the
setter returns, debugfs removal covers the whole operation and exit can no
longer race with an untracked work item.

Validation reproduced this kernel report:
BUG: KASAN: slab-use-after-free in do_enable_set+0x113/0x2e0
Workqueue: events do_enable_set [bluetooth_6lowpan]
The buggy address belongs to the object at ffff888109cb8000

## Which versions are affected by CVE-2026-72337?


## How do I fix CVE-2026-72337?

Apply the vendor's patch.

## Is CVE-2026-72337 being exploited?

There is no known exploitation of CVE-2026-72337 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-72337 and fix it if it is affected.

What it is: CVE-2026-72337 is an use after free vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-72337 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-72337/ (Markdown: https://insights.sbomify.com/CVE-2026-72337/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-72337
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72337
- OSV: https://osv.dev/vulnerability/CVE-2026-72337

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-72337/
Summaries are generated and may contain mistakes; the official description above is the record.