CVE-2026-64452

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> 6lowpan: fix NHC entry use-after-free on error path<br /> <br /> lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding<br /> lowpan_nhc_lock. If the descriptor has no uncompress callback, the error<br /> path drops the lock before printing nhc-&gt;name.<br /> <br /> lowpan_nhc_del() removes descriptors under the same lock and then relies<br /> on synchronize_net() before the owning module can be unloaded. That only<br /> waits for net RX RCU readers. lowpan_header_decompress() is also exported<br /> and can be reached from callers that are not necessarily covered by the net<br /> core RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive<br /> path.<br /> <br /> This leaves a race where one task drops lowpan_nhc_lock in the error path,<br /> another task unregisters and frees the matching descriptor after<br /> synchronize_net() returns, and the first task then dereferences nhc-&gt;name<br /> for the warning.<br /> <br /> With the post-unlock window widened, KASAN reports:<br /> <br /> BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220<br /> Read of size 8<br /> lowpan_nhc_do_uncompression<br /> lowpan_header_decompress<br /> <br /> Fix this by printing the warning before dropping lowpan_nhc_lock, so the<br /> descriptor name is read while unregister is still excluded. The malformed<br /> packet is still rejected with -ENOTSUPP.