Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-63803— hdlc_ppp: sync per-proto timers before freeing hdlc state

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于hdlc_ppp同步释放hdlc状态前每个协议定时器不当，可能导致释放后重用。

CVSS 7.8 · High EPSS 0.13% · P3

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 86d80a231bde4cfb64bfbfbfffd83056fc93628f affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 8308122bc9c065b1f376e081ed300129a2ac9545 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< ce8f9ddca0c9f217342a8b49efd309aa35b81a36 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 508a0139d3bf60f6a03d2fbfb63a89a9463d983a affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< c64dbef1c0fbd36f9530aa75112acdf6a6d3cfd8 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 5a84398101bf9f11e84b176343e4e3ba83e668c0 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< a594debfd4e7ec39413647458907f689ef57fd2f affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< c78a4e41ab5ead6193ad8a2dd92e8906bae659fa affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63803

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
hdlc_ppp: sync per-proto timers before freeing hdlc state
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: hdlc_ppp: sync per-proto timers before freeing hdlc state Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp registers a timer via timer_setup(). That struct ppp is the hdlc->state allocation, which detach_hdlc_protocol() frees with kfree() in both teardown paths: unregister_hdlc_device() and the re-attach inside attach_hdlc_protocol(). The ppp proto never registered a .detach callback, so detach_hdlc_protocol() performs no timer synchronization before the kfree(). The only cancel, timer_delete(&proto->timer) in ppp_cp_event(), is partial (it does not wait for a running callback) and only runs on the ->CLOSED transition; ppp_stop()/ppp_close() do not sync either. A ppp_timer callback already executing (blocked on ppp->lock) survives the kfree and then dereferences proto->state / ppp->lock in freed memory, leading to a use-after-free. Fix this by adding a .detach helper that calls timer_shutdown_sync() on every per-proto timer. detach_hdlc_protocol() invokes proto->detach(dev) before kfree(hdlc->state), so timer_shutdown_sync() now runs on both free paths. timer_shutdown_sync() is used instead of timer_delete_sync() because the keepalive path re-arms the timer through add_timer()/mod_timer() and shutdown blocks any re-activation during teardown. Initialize the per-protocol timers in ppp_ioctl() when the protocol is attached, and remove the now-redundant timer_setup() from ppp_start(), so that the timers are initialized exactly once at attach time and ppp_timer_release() never operates on uninitialized timer_list structures. attach_hdlc_protocol() uses kmalloc() (not kzalloc), so struct ppp's protos[i].timer is uninitialized garbage until the first timer_setup(); without this init-at-attach, attaching the PPP protocol without ever bringing the device up would leave timer_shutdown_sync() operating on uninitialized memory in .detach. Moving the init out of ppp_start() (which only runs on NETDEV_UP) into the attach path makes the initialization unconditional and avoids initializing the same timer_list twice. This bug was found by static analysis.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于hdlc_ppp同步释放hdlc状态前每个协议定时器不当，可能导致释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ~ 86d80a231bde4cfb64bfbfbfffd83056fc93628f -
Linux Linux 2.6.12 -

II. Public POCs for CVE-2026-63803

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63803

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-63803 (7)

Same Patch Batch · Linux · 2026-07-19 · 429 CVEs total

CVE-2026-63795 10.0 CRITICAL 9p: avoid putting oldfid in p9_client_walk() error path
CVE-2026-64091 9.8 CRITICAL batman-adv: tt: fix TOCTOU race for reported vlans
CVE-2026-63984 9.8 CRITICAL ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
CVE-2026-64025 9.8 CRITICAL bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
CVE-2026-63922 9.8 CRITICAL ipv6: exthdrs: refresh nh after handling HAO option
CVE-2026-63979 9.8 CRITICAL net/handshake: hand off the pinned file reference to accept_doit
CVE-2026-64056 9.8 CRITICAL net: ethernet: cortina: Make RX SKB per-port
CVE-2026-63800 9.8 CRITICAL pNFS: Fix use-after-free in pnfs_update_layout()
CVE-2026-63978 9.8 CRITICAL net/handshake: Drain pending requests at net namespace exit
CVE-2026-64055 9.8 CRITICAL net: ethernet: cortina: Carry over frag counter
CVE-2026-63808 9.8 CRITICAL exfat: fix potential use-after-free in exfat_find_dir_entry()
CVE-2026-64033 9.8 CRITICAL RDMA/rtrs: Fix use-after-free in path file creation cleanup
CVE-2026-63888 9.8 CRITICAL scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
CVE-2026-63887 9.8 CRITICAL scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
CVE-2026-64113 9.8 CRITICAL ixgbevf: fix use-after-free in VEPA multicast source pruning
CVE-2026-63825 9.8 CRITICAL gcov: use atomic counter updates to fix concurrent access crashes
CVE-2026-63857 9.8 CRITICAL net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()
CVE-2026-64160 9.8 CRITICAL netfs: Fix potential for tearing in ->remote_i_size and ->zero_point
CVE-2026-64125 9.8 CRITICAL net: bcmgenet: keep RBUF EEE/PM disabled
CVE-2026-63924 9.8 CRITICAL ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

Showing top 20 of 429 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-63803

No comments yet

Leave a comment