CVE-2026-63803

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hdlc_ppp: sync per-proto timers before freeing hdlc state

Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp

registers a timer via timer_setup(). That struct ppp is the

hdlc->state allocation, which detach_hdlc_protocol() frees with kfree()

in both teardown paths: unregister_hdlc_device() and the re-attach inside

attach_hdlc_protocol().

The ppp proto never registered a .detach callback, so

detach_hdlc_protocol() performs no timer synchronization before the

kfree(). The only cancel, timer_delete(&proto->timer) in ppp_cp_event(),

is partial (it does not wait for a running callback) and only runs on the

->CLOSED transition; ppp_stop()/ppp_close() do not sync either. A

ppp_timer callback already executing (blocked on ppp->lock) survives the

kfree and then dereferences proto->state / ppp->lock in freed memory,

leading to a use-after-free.

Fix this by adding a .detach helper that calls timer_shutdown_sync

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References