CVE-2026-63803
Received Received - Intake

Use-After-Free in Linux Kernel HDLC PPP Protocol

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: hdlc_ppp: sync per-proto timers before freeing hdlc state Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp registers a timer via timer_setup(). That struct ppp is the hdlc->state allocation, which detach_hdlc_protocol() frees with kfree() in both teardown paths: unregister_hdlc_device() and the re-attach inside attach_hdlc_protocol(). The ppp proto never registered a .detach callback, so detach_hdlc_protocol() performs no timer synchronization before the kfree(). The only cancel, timer_delete(&proto->timer) in ppp_cp_event(), is partial (it does not wait for a running callback) and only runs on the ->CLOSED transition; ppp_stop()/ppp_close() do not sync either. A ppp_timer callback already executing (blocked on ppp->lock) survives the kfree and then dereferences proto->state / ppp->lock in freed memory, leading to a use-after-free. Fix this by adding a .detach helper that calls timer_shutdown_sync() on every per-proto timer. detach_hdlc_protocol() invokes proto->detach(dev) before kfree(hdlc->state), so timer_shutdown_sync() now runs on both free paths. timer_shutdown_sync() is used instead of timer_delete_sync() because the keepalive path re-arms the timer through add_timer()/mod_timer() and shutdown blocks any re-activation during teardown. Initialize the per-protocol timers in ppp_ioctl() when the protocol is attached, and remove the now-redundant timer_setup() from ppp_start(), so that the timers are initialized exactly once at attach time and ppp_timer_release() never operates on uninitialized timer_list structures. attach_hdlc_protocol() uses kmalloc() (not kzalloc), so struct ppp's protos[i].timer is uninitialized garbage until the first timer_setup(); without this init-at-attach, attaching the PPP protocol without ever bringing the device up would leave timer_shutdown_sync() operating on uninitialized memory in .detach. Moving the init out of ppp_start() (which only runs on NETDEV_UP) into the attach path makes the initialization unconditional and avoids initializing the same timer_list twice. This bug was found by static analysis.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63803
EUVD
EUVD-2026-45469

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's HDLC PPP implementation. It occurs when PPP control protocol timers are not properly synchronized before freeing memory. The issue arises because timers registered by PPP protocols are not detached or canceled before the underlying hdlc state structure is freed, allowing a timer callback to execute after the memory has been freed and potentially dereference invalid pointers.

Detection Guidance

This vulnerability is specific to the Linux kernel's HDLC PPP implementation and requires kernel-level detection. No standard network or system commands can directly detect it. The issue involves a use-after-free in PPP protocol timers, which may manifest as kernel panics, crashes, or memory corruption during PPP device operations. Monitor kernel logs for oops messages or crashes related to PPP or HDLC modules.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service condition or potentially execute arbitrary code with kernel privileges. It may lead to system crashes, data corruption, or unauthorized access depending on the attacker's capabilities and system configuration.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's PPP over HDLC implementation. It does not directly relate to data protection or privacy standards like GDPR or HIPAA, as it involves kernel memory management rather than data handling or access control.

Mitigation Strategies

Apply the kernel patch that adds timer_shutdown_sync() in the .detach callback and ensures proper timer initialization. Update to a Linux kernel version that includes the fix. If immediate patching is not possible, disable PPP over HDLC protocols or restrict their use until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63803. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart