CVE-2026-63803

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: hdlc_ppp: sync per-proto timers before freeing hdlc state Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp registers a timer via timer_setup(). That struct ppp is the hdlc->state allocation, which detach_hdlc_protocol() frees with kfree() in both teardown paths: unregister_hdlc_device() and the re-attach inside attach_hdlc_protocol(). The ppp proto never registered a .detach callback, so detach_hdlc_protocol() performs no timer synchronization before the kfree(). The only cancel, timer_delete(&proto->timer...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 86d80a231bde4cfb64bfbfbfffd83056fc93628f, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8308122bc9c065b1f376e081ed300129a2ac9545, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ce8f9ddca0c9f217342a8b49efd309aa35b81a36, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 508a0139d3bf60f6a03d2fbfb63a89a9463d983a, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c64dbef1c0fbd36f9530aa75112acdf6a6d3cfd8, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5a84398101bf9f11e84b176343e4e3ba83e668c0, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a594debfd4e7ec39413647458907f689ef57fd2f, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c78a4e41ab5ead6193ad8a2dd92e8906bae659fa, >= 2.6.12, >= 2.6.12.1 < 5.10.261, >= 5.11 < 5.15.211, >= 5.16 < 6.1.177, >= 6.2 < 6.6.144, >= 6.7 < 6.12.95, >= 6.13 < 6.18.38, >= 6.19 < 7.1.3, 2.6.12

Fixed versions

5.10.261, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416