CVE-2026-63803

Zwakheid

In the Linux kernel, the following vulnerability has been resolved: hdlc_ppp: sync per-proto timers before freeing hdlc state Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp registers a timer via timer_setup(). That struct ppp is the hdlc->state allocation, which detach_hdlc_protocol() frees with kfree() in both teardown paths: unregister_hdlc_device() and the re-attach inside attach_hdlc_protocol(). The ppp proto never registered a .detach callback, so detach_hdlc_protocol() performs no timer synchronization before the kfree(). The only cancel, timer_delete(&proto->timer) in ppp_cp_event(), is partial (it does not wait for a running callback) and only runs on the ->CLOSED transition; ppp_stop()/ppp_close() do not sync either. A ppp_timer callback already executing (blocked on ppp->lock) survives the kfree and then dereferences proto->state / ppp->lock in freed memory, leading to a use-after-free. Fix this by adding a .detach helper that calls timer_shutdown_sync() on every per-proto timer. detach_hdlc_protocol() invokes proto->detach(dev) before kfree(hdlc->state), so timer_shutdown_sync() now runs on both free paths. timer_shutdown_sync() is used instead of tim

Getroffen producten

• linux linux_kernel

Bronnen

• https://git.kernel.org/stable/c/508a0139d3bf60f6a03d2fbfb63a89a9463d983a
• https://git.kernel.org/stable/c/5a84398101bf9f11e84b176343e4e3ba83e668c0
• https://git.kernel.org/stable/c/8308122bc9c065b1f376e081ed300129a2ac9545
• https://git.kernel.org/stable/c/86d80a231bde4cfb64bfbfbfffd83056fc93628f
• https://git.kernel.org/stable/c/a594debfd4e7ec39413647458907f689ef57fd2f
• https://git.kernel.org/stable/c/c64dbef1c0fbd36f9530aa75112acdf6a6d3cfd8