UBUNTU-CVE-2026-72337: Use After Free
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpanenableset() allocates a temporary work item and schedules doenableset() on systemwq, then returns to debugfs. The debugfs active operation has ended at that point, but the worker still executes module text and manipulates enable6lowpan and listenchan. bt6lowpanexit() removes the debugfs files and immediately closes and puts listenchan. It has no pointer to the queued work item, so it cannot cancel or flush it before tearing down the state that the worker uses. The buggy scenario involves two paths, with each column showing the order within that path: debugfs enable write module exit 1. lowpanenableset() allocates 1. bt6lowpanexit() removes setenable work the debugfs file 2. schedulework() queues 2. bt6lowpanexit() closes doenableset() and puts listenchan 3. the write operation returns 3. module teardown can continue 4. doenableset() later runs against stale state Run the enable state transition synchronously in lowpanenableset() instead. The simple debugfs setter can sleep, and this file already handles the 6LoWPAN control write synchronously under the same setlock. Once the setter returns, debugfs removal covers the whole operation and exit can no longer race with an untracked work item. Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in doenableset+0x113/0x2e0 Workqueue: events doenableset [bluetooth6lowpan] The buggy address belongs to the object at ffff888109cb8000
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Configuration
Run the enable state transition synchronously in lowpan_enable_set() instead of allocating and scheduling an untracked work item with schedule_work().
Linux kernel Bluetooth 6lowpan lowpan_enable_set() enable state transition = synchronous
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The Bluetooth 6LoWPAN module must be in use, and a write to its debugfs enable control must race with module teardown. The vulnerable path queues enable work that can run after teardown has closed and released the channel state it uses.
Are systems using the listed Ubuntu kernel packages affected by default?
The provided information does not establish whether Bluetooth 6LoWPAN or its debugfs controls are enabled or used by default. Exposure depends on the availability and use of the Bluetooth 6LoWPAN debugfs enable interface and on module removal occurring while its enable operation is pending.
What is the mitigation if an updated kernel cannot be deployed immediately?
Avoid writing to the Bluetooth 6LoWPAN debugfs enable control while the Bluetooth 6LoWPAN module may be unloaded or the system is shutting down that module. Preventing that race avoids queuing work that could later access torn-down state.