310 lines
16 KiB
JSON
310 lines
16 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-64452",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-07-19T15:36:31.788Z",
|
|
"datePublished": "2026-07-25T08:51:21.754Z",
|
|
"dateUpdated": "2026-10-19T20:38:30.450Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-17T04:55:56.222Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\n6lowpan: fix NHC entry use-after-free on error path\n\nlowpan_nhc_do_uncompression() looks up an NHC descriptor while holding\nlowpan_nhc_lock. If the descriptor has no uncompress callback, the error\npath drops the lock before printing nhc->name.\n\nlowpan_nhc_del() removes descriptors under the same lock and then relies\non synchronize_net() before the owning module can be unloaded. That only\nwaits for net RX RCU readers. lowpan_header_decompress() is also exported\nand can be reached from callers that are not necessarily covered by the net\ncore RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive\npath.\n\nThis leaves a race where one task drops lowpan_nhc_lock in the error path,\nanother task unregisters and frees the matching descriptor after\nsynchronize_net() returns, and the first task then dereferences nhc->name\nfor the warning.\n\nWith the post-unlock window widened, KASAN reports:\n\n BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220\n Read of size 8\n lowpan_nhc_do_uncompression\n lowpan_header_decompress\n\nFix this by printing the warning before dropping lowpan_nhc_lock, so the\ndescriptor name is read while unregister is still excluded. The malformed\npacket is still rejected with -ENOTSUPP."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.1,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:A - An adjacent Bluetooth LE peer can deliver a crafted IPHC/NHC frame through the unauthenticated L2CAP IPSP receive path to the vulnerable decompressor.\nAC:H - Exploitation requires the matching loadable NHC descriptor to be unregistered and freed during the tiny post-unlock window, and the adjacent attacker cannot independently force that module-unload side of the race.\nPR:N - The Bluetooth packet-processing path requires no attacker privileges or authenticated pairing because the IPSP channel uses BT_SECURITY_LOW; CAP_SYS_MODULE belongs to the victim-side unload actor.\nUI:R - Successful triggering requires a victim administrator or module-management action to unload the matching NHC module while the malicious packet is being processed.\nS:U - The vulnerability compromises the affected host kernel without crossing a separate virtualization, IOMMU, or security-authority boundary.\nC:H - The freed descriptor's name pointer is dereferenced as a string, so reused contents can cause an unbounded kernel-memory read and disclosure through the kernel log.\nI:H - As a kernel-space use-after-free, freed-object replacement is conservatively treated as potentially enabling memory-corruption or control-flow compromise.\nA:H - Dereferencing an invalid freed descriptor or string pointer can produce a kernel oops or panic and render the system unavailable."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/6lowpan/nhc.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
|
|
"lessThan": "9c2f5c0829a8c8b904dae36be6d8056b719ac605",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
|
|
"lessThan": "80b5c8779acee0550845394fb3e5176a398aa24c",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
|
|
"lessThan": "cc27aea4d454abfb385ee2c9499c78b96db9b728",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
|
|
"lessThan": "a8e3a94711134e898c6021a6b77374efa91b3639",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
|
|
"lessThan": "593b78bb3c7ef0c6e9ae6fdf5afa80a5f7573168",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
|
|
"lessThan": "0beccbcf50de125be5520d0ffc59af4bb8655482",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
|
|
"lessThan": "b713aa0cc344f10f7a9928a230b5f5e780d04078",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
|
|
"lessThan": "1720db928e5a58ca7d75ac1d514c3b73fd7061a7",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/6lowpan/nhc.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4.1",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "4.1",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.261",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.212",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.178",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.145",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.96",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.39",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1.4",
|
|
"lessThanOrEqual": "7.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.1",
|
|
"versionEndExcluding": "5.10.261"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.1",
|
|
"versionEndExcluding": "5.15.212"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.1",
|
|
"versionEndExcluding": "6.1.178"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.1",
|
|
"versionEndExcluding": "6.6.145"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.1",
|
|
"versionEndExcluding": "6.12.96"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.1",
|
|
"versionEndExcluding": "6.18.39"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.1",
|
|
"versionEndExcluding": "7.1.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.1",
|
|
"versionEndExcluding": "7.2"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/9c2f5c0829a8c8b904dae36be6d8056b719ac605"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/80b5c8779acee0550845394fb3e5176a398aa24c"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/cc27aea4d454abfb385ee2c9499c78b96db9b728"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a8e3a94711134e898c6021a6b77374efa91b3639"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/593b78bb3c7ef0c6e9ae6fdf5afa80a5f7573168"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/0beccbcf50de125be5520d0ffc59af4bb8655482"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b713aa0cc344f10f7a9928a230b5f5e780d04078"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1720db928e5a58ca7d75ac1d514c3b73fd7061a7"
|
|
}
|
|
],
|
|
"title": "6lowpan: fix NHC entry use-after-free on error path",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2026-64452",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-10-16T15:41:07.187657Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"type": "CWE",
|
|
"cweId": "CWE-416",
|
|
"description": "CWE-416 Use After Free"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-19T20:38:30.450Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |