Use-after-free in Linux kernel - CVE-2026-64452
Published: July 27, 2026
Vulnerability identifier: #VU139482
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64452
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in lowpan_nhc_do_uncompression() when processing a malformed 6LoWPAN packet on an error path. A remote attacker can send a specially crafted packet to cause a denial of service.
The issue is caused by a race condition involving descriptor unregistration and access to nhc->name outside the protection of lowpan_nhc_lock, and it can be reached through the Bluetooth 6LoWPAN L2CAP receive path.
Affected software
Linux kernel
How to mitigate CVE-2026-64452
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/0beccbcf50de125be5520d0ffc59af4bb8655482
- https://git.kernel.org/stable/c/1720db928e5a58ca7d75ac1d514c3b73fd7061a7
- https://git.kernel.org/stable/c/593b78bb3c7ef0c6e9ae6fdf5afa80a5f7573168
- https://git.kernel.org/stable/c/80b5c8779acee0550845394fb3e5176a398aa24c
- https://git.kernel.org/stable/c/9c2f5c0829a8c8b904dae36be6d8056b719ac605
- https://git.kernel.org/stable/c/a8e3a94711134e898c6021a6b77374efa91b3639
- https://git.kernel.org/stable/c/b713aa0cc344f10f7a9928a230b5f5e780d04078
- https://git.kernel.org/stable/c/cc27aea4d454abfb385ee2c9499c78b96db9b728