CVE-2026-63803

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> hdlc_ppp: sync per-proto timers before freeing hdlc state<br /> <br /> Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp<br /> registers a timer via timer_setup(). That struct ppp is the<br /> hdlc-&gt;state allocation, which detach_hdlc_protocol() frees with kfree()<br /> in both teardown paths: unregister_hdlc_device() and the re-attach inside<br /> attach_hdlc_protocol().<br /> <br /> The ppp proto never registered a .detach callback, so<br /> detach_hdlc_protocol() performs no timer synchronization before the<br /> kfree(). The only cancel, timer_delete(&amp;proto-&gt;timer) in ppp_cp_event(),<br /> is partial (it does not wait for a running callback) and only runs on the<br /> -&gt;CLOSED transition; ppp_stop()/ppp_close() do not sync either. A<br /> ppp_timer callback already executing (blocked on ppp-&gt;lock) survives the<br /> kfree and then dereferences proto-&gt;state / ppp-&gt;lock in freed memory,<br /> leading to a use-after-free.<br /> <br /> Fix this by adding a .detach helper that calls timer_shutdown_sync() on<br /> every per-proto timer. detach_hdlc_protocol() invokes proto-&gt;detach(dev)<br /> before kfree(hdlc-&gt;state), so timer_shutdown_sync()<br /> now runs on both free paths.<br /> timer_shutdown_sync() is used instead of timer_delete_sync() because the<br /> keepalive path re-arms the timer through add_timer()/mod_timer() and<br /> shutdown blocks any re-activation during teardown.<br /> <br /> Initialize the per-protocol timers in ppp_ioctl() when the protocol is<br /> attached, and remove the now-redundant timer_setup() from ppp_start(), so<br /> that the timers are initialized exactly once at attach time and<br /> ppp_timer_release() never operates on uninitialized timer_list<br /> structures. attach_hdlc_protocol() uses kmalloc() (not kzalloc), so<br /> struct ppp&amp;#39;s protos[i].timer is uninitialized garbage until the first<br /> timer_setup(); without this init-at-attach, attaching the PPP protocol<br /> without ever bringing the device up would leave timer_shutdown_sync()<br /> operating on uninitialized memory in .detach. Moving the init out of<br /> ppp_start() (which only runs on NETDEV_UP) into the attach path makes the<br /> initialization unconditional and avoids initializing the same timer_list<br /> twice.<br /> <br /> This bug was found by static analysis.