CVE-2026-63803: hdlc_ppp: sync per-proto timers before freeing hdlc state

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Upgrade

   Upgrade to a fixed release to a version that resolves this vulnerability.

   Fixed in 6.6.150.1-1
2. Configuration

   Implement a .detach helper for each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp that calls timer_shutdown_sync() to synchronize per-protocol timers before teardown frees memory (avoid use-after-free in detach_hdlc_protocol()).

   Linux kernel PPP driver (hdlc_ppp / ppp) ppp proto detach behavior for per-protocol timers (proto->detach) = Call timer_shutdown_sync() in new .detach helper before freeing/detaching state
3. Configuration

   Move initialization of per-protocol timers out of ppp_start() into ppp_ioctl() (attach/registration path). Remove the now-redundant timer_setup() from ppp_start() so proto->timer is initialized exactly once at attach time and ppp_timer callback teardown uses synchronized shutdown.

   Linux kernel ppp protocol initialization (in struct ppp / ppp_ioctl / attach path) Per-protocol timers initialization timing = Initialize in ppp_ioctl() when protocol is selected; remove redundant timer_setup() from ppp_start()
4. Operational

   Ensure teardown calls proto->detach(dev) (via detach_hdlc_protocol()) only after per-protocol timers have been synchronized with timer_shutdown_sync(), including both teardown paths: unregister_hdlc_device() and the re-attach/second free path where hdlc->state is freed with kfree().

Event History

Frequently Asked Questions