CVE-2026-63803

In the Linux kernel, the following vulnerability has been resolved:

hdlc_ppp: sync per-proto timers before freeing hdlc state

Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp

registers a timer via timer_setup(). That struct ppp is the

hdlc->state allocation, which detach_hdlc_protocol() frees with kfree()

in both teardown paths: unregister_hdlc_device() and the re-attach inside

attach_hdlc_protocol().

The ppp proto never registered a .detach callback, so

detach_hdlc_protocol() performs no timer synchronization before the

kfree(). The only cancel, timer_delete(&proto->timer) in ppp_cp_event(),

is partial (it does not wait for a running callback) and only runs on the

->CLOSED transition; ppp_stop()/ppp_close() do not sync either. A

ppp_timer callback already executing (blocked on ppp->lock) survives the

kfree and then dereferences proto->state / ppp->lock in freed memory,

leading to a use-after-free.

Fix this by adding a .detach helper that calls timer_shutdown_sync() on

every per-proto timer. detach_hdlc_protocol() invokes proto->detach(dev)

before kfree(hdlc->state), so timer_shutdown_sync()

now runs on both free paths.

timer_shutdown_sync() is used instead of timer_delete_sync() because the

keepalive path re-arms the timer through add_timer()/mod_timer() and

shutdown blocks any re-activation during teardown.

Initialize the per-protocol timers in ppp_ioctl() when the protocol is

attached, and remove the now-redundant timer_setup() from ppp_start(), so

that the timers are initialized exactly once at attach time and

ppp_timer_release() never operates on uninitialized timer_list

structures. attach_hdlc_protocol() uses kmalloc() (not kzalloc), so

struct ppp's protos[i].timer is uninitialized garbage until the first

timer_setup(); without this init-at-attach, attaching the PPP protocol

without ever bringing the device up would leave timer_shutdown_sync()

operating on uninitialized memory in .detach. Moving the init out of

ppp_start() (which only runs on NETDEV_UP) into the attach path makes the

initialization unconditional and avoids initializing the same timer_list

twice.

This bug was found by static analysis.