CVE-2026-72337

A flaw was found in the Linux kernel's Bluetooth 6LoWPAN (IPv6 over Low-Power Wireless Personal Area Networks) component. This vulnerability occurs due to a race condition during the module's exit process, where a scheduled task attempts to access memory that has already been released. A local attacker could exploit this use-after-free condition, leading to memory corruption. This could potentially result in a system crash (denial of service) or, in some scenarios, allow for arbitrary code execution.

This vulnerability is rated as Moderate impact for Red Hat because exploitation requires local access and precise timing during module teardown to induce memory corruption. In addition, triggering the flaw relies on interacting with debugfs write handlers, which are typically restricted to administrative users on standard deployments. Red Hat Enterprise Linux is not affected as the vulnerable Bluetooth 6LoWPAN code is not enabled in supported kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.