CVE-2026-64452: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64452 Overview

CVE-2026-64452 is a use-after-free vulnerability in the Linux kernel's 6LoWPAN (IPv6 over Low-Power Wireless Personal Area Networks) subsystem. The flaw resides in lowpan_nhc_do_uncompression(), which looks up a Next Header Compression (NHC) descriptor while holding lowpan_nhc_lock. When the descriptor lacks an uncompress callback, the error path drops the lock before printing nhc->name, opening a race window against lowpan_nhc_del(). An attacker on an adjacent network can exploit this race through the Bluetooth 6LoWPAN L2CAP receive path.

Critical Impact
A race condition allows a freed NHC descriptor to be dereferenced in kernel context, resulting in a use-after-free that KASAN confirms as a slab-use-after-free read in lowpan_nhc_do_uncompression.

Affected Products

Linux kernel builds that enable the 6LoWPAN subsystem (net/6lowpan)
Bluetooth 6LoWPAN L2CAP receive path consumers of lowpan_header_decompress()
Stable kernel branches prior to the fix commits referenced in the upstream kernel git tree

Discovery Timeline

2026-07-25 - CVE-2026-64452 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64452

Vulnerability Analysis

The defect is a classic post-unlock race in the 6LoWPAN NHC dispatch layer. lowpan_nhc_do_uncompression() acquires lowpan_nhc_lock, resolves an NHC descriptor for the incoming compressed header, and validates that an uncompress callback exists. If the callback is missing, the function releases the lock and then reads nhc->name to emit a warning about the unsupported header. The descriptor pointer is used after the lock is dropped.

lowpan_nhc_del() removes descriptors while holding the same lock and relies on synchronize_net() before the owning module can be unloaded. synchronize_net() only waits for net RX RCU readers, which does not cover all callers of the exported lowpan_header_decompress(). The Bluetooth 6LoWPAN L2CAP receive path invokes decompression outside that RCU critical section.

Root Cause

The root cause is inadequate lifetime management of NHC descriptor objects across module unregistration. The error path in lowpan_nhc_do_uncompression() dereferences descriptor memory after releasing the lock that serializes registration and removal. Because synchronize_net() does not fence non-net RX callers, a concurrent lowpan_nhc_del() can free the descriptor between the unlock and the nhc->name read.

Attack Vector

Exploitation requires the attacker to reach the 6LoWPAN decompression path, typically over Bluetooth Low Energy through the L2CAP channel used by the Bluetooth 6LoWPAN driver. Sending a malformed compressed IPv6 header selecting an NHC entry that lacks an uncompress handler triggers the error path. Timing the transmission with an NHC module unload race causes the kernel to read from freed slab memory. KASAN reports the condition as BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220.

The upstream fix moves the warning emission to occur before lowpan_nhc_lock is released, so nhc->name is read while unregister remains excluded. The malformed packet is still rejected with -ENOTSUPP. See the upstream commits for the exact change, including Kernel Git Commit b713aa0 and Kernel Git Commit cc27aea.

Detection Methods for CVE-2026-64452

Indicators of Compromise

KASAN reports in kernel logs matching slab-use-after-free in lowpan_nhc_do_uncompression
Unexpected kernel warnings or oopses originating from lowpan_header_decompress on hosts running Bluetooth 6LoWPAN
-ENOTSUPP responses correlated with Bluetooth L2CAP traffic carrying unusual NHC identifiers

Detection Strategies

Enable KASAN on test kernels to surface the use-after-free during fuzzing of the 6LoWPAN receive path
Audit loaded modules for nhc_* entries and monitor rmmod/modprobe activity for NHC handlers on production hosts
Correlate Bluetooth 6LoWPAN adapter events with kernel ring buffer messages referencing lowpan_nhc

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized SIEM and alert on stack traces containing lowpan_nhc_do_uncompression
Track kernel module load and unload events using auditd rules on init_module and delete_module syscalls
Monitor Bluetooth L2CAP packet volumes on IoT gateways where the 6LoWPAN stack is active

How to Mitigate CVE-2026-64452

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry to all affected stable branches
Disable the bluetooth_6lowpan and 6lowpan kernel modules on systems that do not require 6LoWPAN connectivity
Restrict physical proximity and Bluetooth pairing on IoT gateways that use 6LoWPAN over BLE

Patch Information

The fix is available in multiple upstream commits including Kernel Git Commit 0beccbc, Kernel Git Commit 1720db9, Kernel Git Commit 593b78b, Kernel Git Commit 80b5c87, Kernel Git Commit 9c2f5c0, and Kernel Git Commit a8e3a94. Consume vendor-provided kernel updates from your Linux distribution's security channel as they become available.

Workarounds

Blocklist the 6lowpan and bluetooth_6lowpan modules on hosts without a Bluetooth 6LoWPAN requirement
Remove or disable Bluetooth adapters on servers that do not need short-range wireless connectivity
Limit access to trusted Bluetooth peers to reduce exposure of the adjacent network attack surface

bash

# Configuration example: prevent the vulnerable modules from loading
echo "install 6lowpan /bin/true" | sudo tee /etc/modprobe.d/disable-6lowpan.conf
echo "install bluetooth_6lowpan /bin/true" | sudo tee -a /etc/modprobe.d/disable-6lowpan.conf
sudo update-initramfs -u