Executive brief
A vulnerability was identified in the Linux kernel's HDLC PPP implementation, a component used for wide-area network (WAN) communications. Under specific conditions during network device reconfiguration or shutdown, the system may attempt to use memory that has already been freed. This can lead to a system crash or unpredictable behavior, potentially impacting the availability of the affected server or networking equipment.
Technical details
A use-after-free vulnerability exists in drivers/net/wan/hdlc_ppp.c in the Linux kernel. The root cause is the lack of a .detach callback in the PPP protocol structure, which prevents detach_hdlc_protocol() from synchronizing or canceling per-protocol timers (LCP/IPCP/IPV6CP) before freeing the hdlc->state memory via kfree(). An attacker or a specific sequence of system events could trigger a race condition where a timer callback executes after the memory it references has been freed, leading to a kernel panic. The fix introduces a .detach helper that utilizes timer_shutdown_sync() to ensure all timers are stopped and synchronized before memory deallocation. This issue was discovered via static analysis and affects versions dating back to the 2.6.12-rc2 release.
Affected products
- Linux Linux Kernel v2.6.12-rc2 to v6.10
Timeline
- 2026-06-17: disclosed: Initial patch submission by Fan Wu
- 2026-07-04: patched: Patch committed to stable branches by Greg Kroah-Hartman
- 2026-07-19: advisory: CVE-2026-63803 published
References
- https://git.kernel.org/stable/c/508a0139d3bf60f6a03d2fbfb63a89a9463d983a
- https://git.kernel.org/stable/c/5a84398101bf9f11e84b176343e4e3ba83e668c0
- https://git.kernel.org/stable/c/8308122bc9c065b1f376e081ed300129a2ac9545
- https://git.kernel.org/stable/c/a594debfd4e7ec39413647458907f689ef57fd2f
- https://git.kernel.org/stable/c/c64dbef1c0fbd36f9530aa75112acdf6a6d3cfd8
- https://git.kernel.org/stable/c/c78a4e41ab5ead6193ad8a2dd92e8906bae659fa
- https://git.kernel.org/stable/c/ce8f9ddca0c9f217342a8b49efd309aa35b81a36