PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64452 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's 6lowpan implementation. The issue arises from the `lowpan_nhc_do_uncompression` function, which looks up an NHC descriptor while holding `lowpan_nhc_lock`. If the descriptor has no uncompress callback, the error path drops the lock before printing `nhc->name`. This creates a race condition where another task can unregister and free the descriptor after `synchronize_net()` returns, leading to a use-after-free error when the first task attempts to access `nhc->name`.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-25
Original CVE updated
2026-10-19
Advisory published
2026-07-25
Advisory updated
2026-10-19

Who should care

Defenders responsible for Linux kernel deployments, particularly those using Bluetooth 6LoWPAN L2CAP receive paths, should assess exposure and prioritize patching vulnerable versions.

Why it matters

CVE-2026-64452 is a use-after-free vulnerability in the Linux kernel's 6lowpan implementation. Defenders should prioritize patching vulnerable versions, particularly those exposed to Bluetooth 6LoWPAN L2CAP receive paths, and monitor for potential exploitation attempts.

  • Potential for use-after-free errors leading to system crashes or instability
  • Possible exploitation attempts via Bluetooth 6LoWPAN L2CAP receive paths
  • Need for patching vulnerable Linux kernel versions to prevent exploitation
  • Importance of monitoring for potential exploitation attempts

Technical summary

The Linux kernel's 6lowpan implementation is vulnerable to a use-after-free error. The `lowpan_nhc_do_uncompression` function accesses an NHC descriptor after the lock is dropped, creating a race condition with tasks unregistering and freeing the descriptor. This can lead to system crashes or instability, particularly in Bluetooth 6LoWPAN L2CAP receive paths. Defenders should prioritize patching vulnerable Linux kernel versions and monitor for potential exploitation attempts. The vulnerability exists due to the lack of proper synchronization between the `lowpan_nhc_do_uncompression` function and the `lowpan_nhc_del` function, which can lead to a use-after-free error when accessing the NHC descriptor. To exploit

Defensive priority

Defenders should prioritize patching vulnerable Linux kernel versions, particularly those exposed to Bluetooth 6LoWPAN L2CAP receive paths, and monitor for potential exploitation attempts.

Recommended defensive actions

  • Patch vulnerable Linux kernel versions
  • Monitor for potential exploitation attempts
  • Review and update affected Linux deployments
  • Conduct a thorough review of exposed Linux kernel deployments
  • Implement compensating controls for exposed systems
  • Track exceptions and retest remediated assets
  • Verify patch deployment and document evidence

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in the Linux kernel's 6lowpan implementation and the potential for use-after-free errors. However, specific details on exploitation and affected versions are limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-64452 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-64452

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-64452 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-64452

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • 6lowpan: fix NHC entry use-after-free on error path

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/64xxx/CVE-2026-64452.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9c2f5c0829a8c8b904dae36be6d8056b719ac605

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/80b5c8779acee0550845394fb3e5176a398aa24c

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/cc27aea4d454abfb385ee2c9499c78b96db9b728

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a8e3a94711134e898c6021a6b77374efa91b3639

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/593b78bb3c7ef0c6e9ae6fdf5afa80a5f7573168

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0beccbcf50de125be5520d0ffc59af4bb8655482

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b713aa0cc344f10f7a9928a230b5f5e780d04078

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.