CVE-2026-63803 — linux / linux_kernel
Use After FreeIn the Linux kernel, the following vulnerability has been resolved:
hdlc_ppp: sync per-proto timers before freeing hdlc state
Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp registers a timer via timer_setup(). That struct ppp is the hdlc->state allocation, which detach_hdlc_protocol() frees with kfree() in both teardown paths: unregister_hdlc_device() and the re-attach inside attach_hdlc_protocol().
The ppp proto never registered a .detach callback, so detach_hdlc_protocol() performs no timer synchronization before the kfree(). The only cancel, timer_delete(&proto->timer) in ppp_cp_event(), is partial (it does not wait for a running callback) and only runs on the ->CLOSED transition; ppp_stop()/ppp_close() do not sync either. A ppp_timer callback already executing (blocked on ppp->lock) survives the kfree and then dereferences proto->state / ppp->lock in freed memory, leading to a use-after-free.
Fix this by adding a .detach helper that calls timer_shutdown_sync() on every per-proto timer. detach_hdlc_protocol() invokes proto->detach(dev) before kfree(hdlc->state), so timer_shutdown_sync() now runs on both free paths. timer_shutdown_sync() is used instead of timer_delete_sync() because the keepalive path re-arms the timer through add_timer()/mod_timer() and shutdown blocks any re-activation during teardown.
Initialize the per-protocol timers in ppp_ioctl() when the protocol is attached, and remove the now-redundant timer_setup() from ppp_start(), so that the timers are initialized exactly once at attach time and ppp_timer_release() never operates on uninitialized timer_list structures. attach_hdlc_protocol() uses kmalloc() (not kzalloc), so struct ppp's protos[i].timer is uninitialized garbage until the first timer_setup(); without this init-at-attach, attaching the PPP protocol without ever bringing the device up would leave timer_shutdown_sync() operating on uninitialized memory in .detach. Moving the init out of ppp_start() (which only runs on NETDEV_UP) into the attach path makes the initialization unconditional and avoids initializing the same timer_list twice.
This bug was found by static analysis.
| Software | From | Fixed in |
|---|---|---|
| linux / linux_kernel | 2.6.12.1 | 5.10.261 |
| linux / linux_kernel | 5.11 | 5.15.211 |
| linux / linux_kernel | 5.16 | 6.1.177 |
| linux / linux_kernel | 6.2 | 6.6.144 |
| linux / linux_kernel | 6.7 | 6.12.95 |
| linux / linux_kernel | 6.13 | 6.18.38 |
| linux / linux_kernel | 6.19 | 7.1.3 |
| linux / linux_kernel | 2.6.12 | 2.6.12.x |
| linux / linux_kernel | 2.6.12-rc2 | 2.6.12-rc2.x |
| linux / linux_kernel | 2.6.12-rc3 | 2.6.12-rc3.x |
| linux / linux_kernel | 2.6.12-rc4 | 2.6.12-rc4.x |
| linux / linux_kernel | 2.6.12-rc5 | 2.6.12-rc5.x |
- https://git.kernel.org/stable/c/508a0139d3bf60f6a03d2fbfb63a89a9463d983a
- https://git.kernel.org/stable/c/5a84398101bf9f11e84b176343e4e3ba83e668c0
- https://git.kernel.org/stable/c/8308122bc9c065b1f376e081ed300129a2ac9545
- https://git.kernel.org/stable/c/86d80a231bde4cfb64bfbfbfffd83056fc93628f
- https://git.kernel.org/stable/c/a594debfd4e7ec39413647458907f689ef57fd2f
- https://git.kernel.org/stable/c/c64dbef1c0fbd36f9530aa75112acdf6a6d3cfd8
- https://git.kernel.org/stable/c/c78a4e41ab5ead6193ad8a2dd92e8906bae659fa
- https://git.kernel.org/stable/c/ce8f9ddca0c9f217342a8b49efd309aa35b81a36
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime
Frequently Asked Questions
A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.
CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.
A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.
Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.
Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.
SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.