CVE-2026-63803
published 2026-07-19CVE-2026-63803: In the Linux kernel, the following vulnerability has been resolved: hdlc_ppp: sync per-proto timers before freeing hdlc state Each PPP control protocol…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.13%
3.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
hdlc_ppp: sync per-proto timers before freeing hdlc state
Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp
registers a timer via timer_setup(). That struct ppp is the
hdlc->state allocation, which detach_hdlc_protocol() frees with kfree()
in both teardown paths: unregister_hdlc_device() and the re-attach inside
attach_hdlc_protocol().
The ppp proto never registered a .detach callback, so
detach_hdlc_protocol() performs no timer synchronization before the
kfree(). The only cancel, timer_delete(&proto->timer) in ppp_cp_event(),
is partial (it does not wait for a running callback) and only runs on the
->CLOSED transition; ppp_stop()/ppp_close() do not sync either. A
ppp_timer callback already executing (blocked on ppp->lock) survives the
kfree and then dereferences proto->state / ppp->lock in freed memory,
leading to a use-after-free.
Fix this by adding a .detach helper that calls timer_shutdown_sync() on
every per-proto timer. detach_hdlc_protocol() invokes proto->detach(dev)
before kfree(hdlc->state), so timer_shutdown_sync()
now runs on both free paths.
timer_shutdown_sync() is used instead of timer_delete_sync() because the
keepalive path re-arms the timer through add_timer()/mod_timer() and
shutdown blocks any re-activation during teardown.
Initialize the per-protocol timers in ppp_ioctl() when the protocol is
attached, and remove the now-redundant timer_setup() from ppp_start(), so
that the timers are initialized exactly once at attach time and
ppp_timer_release() never operates on uninitialized timer_list
structures. attach_hdlc_protocol() uses kmalloc() (not kzalloc), so
struct ppp's protos[i].timer is uninitialized garbage until the first
timer_setup(); without this init-at-attach, attaching the PPP protocol
without ever bringing the device up would leave timer_shutdown_sync()
operating on uninitialized memory in .detach. Moving the init out of
ppp_start() (which only ru
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 86d80a231bde4cfb64bfbfbfffd83056fc93628f | 86d80a231bde4cfb64bfbfbfffd83056fc93628f |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8308122bc9c065b1f376e081ed300129a2ac9545 | 8308122bc9c065b1f376e081ed300129a2ac9545 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ce8f9ddca0c9f217342a8b49efd309aa35b81a36 | ce8f9ddca0c9f217342a8b49efd309aa35b81a36 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 508a0139d3bf60f6a03d2fbfb63a89a9463d983a | 508a0139d3bf60f6a03d2fbfb63a89a9463d983a |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c64dbef1c0fbd36f9530aa75112acdf6a6d3cfd8 | c64dbef1c0fbd36f9530aa75112acdf6a6d3cfd8 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5a84398101bf9f11e84b176343e4e3ba83e668c0 | 5a84398101bf9f11e84b176343e4e3ba83e668c0 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a594debfd4e7ec39413647458907f689ef57fd2f | a594debfd4e7ec39413647458907f689ef57fd2f |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c78a4e41ab5ead6193ad8a2dd92e8906bae659fa | c78a4e41ab5ead6193ad8a2dd92e8906bae659fa |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 2.6.12.1 < 5.10.261 | 5.10.261 |
| linux | linux_kernel | >= 5.11 < 5.15.211 | 5.15.211 |
| linux | linux_kernel | >= 5.16 < 6.1.177 | 6.1.177 |
| linux | linux_kernel | >= 6.13 < 6.18.38 | 6.18.38 |
| linux | linux_kernel | >= 6.19 < 7.1.3 | 7.1.3 |
| linux | linux_kernel | >= 6.2 < 6.6.144 | 6.6.144 |
| linux | linux_kernel | >= 6.7 < 6.12.95 | 6.12.95 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: hdlc_ppp: sync per-proto timers before freeing hdlc state
vendor_redhat·2026-07-19·CVSS 7.8
CVE-2026-63803 [HIGH] CWE-825 kernel: hdlc_ppp: sync per-proto timers before freeing hdlc state
kernel: hdlc_ppp: sync per-proto timers before freeing hdlc state
In the Linux kernel, the following vulnerability has been resolved:
hdlc_ppp: sync per-proto timers before freeing hdlc state
Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp
registers a timer via timer_setup(). That struct ppp is the
hdlc->state allocation, which detach_hdlc_protocol() frees with kfree()
in both teardown paths: unregister_hdlc_device() and the re-attach inside
attach_hdlc_protocol().
The ppp proto never registered a .detach callback, so
detach_hdlc_protocol() performs no timer synchronization before the
kfree(). The only cancel, timer_delete(&proto->timer) in ppp_cp_event(),
is partial (it does not wait for a running callback) and only runs on the
->CLOSED transition; ppp_stop()/ppp_close
GHSA
In the Linux kernel, the following vulnerability has been resolved: hdlc_ppp: sync per-proto timers before freeing hdlc state Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp regis
ghsa_unreviewed·2026-07-19
CVE-2026-63803 [HIGH] In the Linux kernel, the following vulnerability has been resolved: hdlc_ppp: sync per-proto timers before freeing hdlc state Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp regis
In the Linux kernel, the following vulnerability has been resolved:
hdlc_ppp: sync per-proto timers before freeing hdlc state
Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp
registers a timer via timer_setup(). That struct ppp is the
hdlc->state allocation, which detach_hdlc_protocol() frees with kfree()
in both teardown paths: unregister_hdlc_device() and the re-attach inside
attach_hdlc_protocol().
The ppp proto never registered a .detach callback, so
detach_hdlc_protocol() performs no timer synchronization before the
kfree(). The only cancel, timer_delete(&proto->timer) in ppp_cp_event(),
is partial (it does not wait for a running callback) and only runs on the
->CLOSED transition; ppp_stop()/ppp_close() do not sync either. A
ppp_timer callback already executing (b
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/508a0139d3bf60f6a03d2fbfb63a89a9463d983ahttps://git.kernel.org/stable/c/5a84398101bf9f11e84b176343e4e3ba83e668c0https://git.kernel.org/stable/c/8308122bc9c065b1f376e081ed300129a2ac9545https://git.kernel.org/stable/c/86d80a231bde4cfb64bfbfbfffd83056fc93628fhttps://git.kernel.org/stable/c/a594debfd4e7ec39413647458907f689ef57fd2fhttps://git.kernel.org/stable/c/c64dbef1c0fbd36f9530aa75112acdf6a6d3cfd8https://git.kernel.org/stable/c/c78a4e41ab5ead6193ad8a2dd92e8906bae659fahttps://git.kernel.org/stable/c/ce8f9ddca0c9f217342a8b49efd309aa35b81a36
2026-07-19
Published