Executive brief
A vulnerability was identified in the Linux kernel's 6LoWPAN networking component, which is used to enable IPv6 communication over low-power wireless networks like Bluetooth. A technical flaw in how the system handles malformed network packets could lead to a system crash or instability. This issue primarily affects devices using specific wireless protocols and has been resolved in recent kernel updates.
Technical details
A use-after-free (UAF) vulnerability exists in net/6lowpan/nhc.c within the lowpan_nhc_do_uncompression() function. The root cause is a race condition where the 'lowpan_nhc_lock' is released before accessing 'nhc->name' in an error path. If a concurrent task unregisters and frees the NHC descriptor (via lowpan_nhc_del) after the lock is dropped but before the name is printed, a UAF occurs. This is particularly reachable via the Bluetooth 6LoWPAN L2CAP receive path, which may not be covered by standard network RX RCU critical sections. The fix involves moving the diagnostic print statement inside the locked section to ensure the descriptor remains valid during access.
Affected products
- Linux Linux 92aa7c65d295 to 9c2f5c0829a8, 80b5c8779ace, cc27aea4d454, a8e3a9471113, 593b78bb3c7e, 0beccbcf50de
Timeline
- 2026-06-09: other: Vulnerability reported by researchers
- 2026-07-18: patched: Fix committed to stable kernel trees
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0beccbcf50de125be5520d0ffc59af4bb8655482
- https://git.kernel.org/stable/c/1720db928e5a58ca7d75ac1d514c3b73fd7061a7
- https://git.kernel.org/stable/c/593b78bb3c7ef0c6e9ae6fdf5afa80a5f7573168
- https://git.kernel.org/stable/c/80b5c8779acee0550845394fb3e5176a398aa24c
- https://git.kernel.org/stable/c/9c2f5c0829a8c8b904dae36be6d8056b719ac605
- https://git.kernel.org/stable/c/a8e3a94711134e898c6021a6b77374efa91b3639
- https://git.kernel.org/stable/c/b713aa0cc344f10f7a9928a230b5f5e780d04078