CVE-2026-64452: 6lowpan: fix NHC entry use-after-free on error path
6lowpan: fix NHC entry use-after-free on error path
Affected Software
Remediation
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The vulnerable path requires an NHC descriptor without an uncompress callback, followed by an error path that releases lowpan_nhc_lock. A concurrent task must then unregister and free that descriptor before the first task reads its name for a warning.
Which execution paths are particularly relevant when assessing exposure?
The issue is relevant to callers of the exported lowpan_header_decompress() function that are not necessarily protected by the network core RX critical section. The Bluetooth 6LoWPAN L2CAP receive path is identified as one such example.
How can an already-triggered issue be identified?
KASAN may report a slab use-after-free in lowpan_nhc_do_uncompression, with lowpan_header_decompress appearing in the call path. The reported invalid access is a read of nhc->name after the descriptor has been freed.
What should be done if the affected code is present?
A patch is available. No configuration-based mitigation or workaround is specified in the provided information.