In the Linux kernel, the following vulnerability has been resolved:
hdlc_ppp: sync per-proto timers before freeing hdlc state
Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp registers a timer via timersetup(). That struct ppp is the hdlc->state allocation, which detachhdlcprotocol() frees with kfree() in both teardown paths: unregisterhdlcdevice() and the re-attach inside attachhdlc_protocol().
The ppp proto never registered a .detach callback, so detachhdlcprotocol() performs no timer synchronization before the kfree(). The only cancel, timerdelete(&proto->timer) in pppcpevent(), is partial (it does not wait for a running callback) and only runs on the ->CLOSED transition; pppstop()/pppclose() do not sync either. A ppptimer callback already executing (blocked on ppp->lock) survives the kfree and then dereferences proto->state / ppp->lock in freed memory, leading to a use-after-free.
Fix this by adding a .detach helper that calls timershutdownsync() on every per-proto timer. detachhdlcprotocol() invokes proto->detach(dev) before kfree(hdlc->state), so timershutdownsync() now runs on both free paths. timershutdownsync() is used instead of timerdeletesync() because the keepalive path re-arms the timer through addtimer()/modtimer() and shutdown blocks any re-activation during teardown.
Initialize the per-protocol timers in pppioctl() when the protocol is attached, and remove the now-redundant timersetup() from pppstart(), so that the timers are initialized exactly once at attach time and ppptimerrelease() never operates on uninitialized timerlist structures. attachhdlcprotocol() uses kmalloc() (not kzalloc), so struct ppp's protos[i].timer is uninitialized garbage until the first timersetup(); without this init-at-attach, attaching the PPP protocol without ever bringing the device up would leave timershutdownsync() operating on uninitialized memory in .detach. Moving the init out of pppstart() (which only runs on NETDEVUP) into the attach path makes the initialization unconditional and avoids initializing the same timerlist twice.
This bug was found by static analysis.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63803.json",
"cna_assigner": "Linux"
}