PT-2026-61119 · Linux · Linux Kernel

CVE-2026-63803 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the HDLC PPP protocol implementation. The struct ppp (allocated as hdlc->state) registers timers for PPP control protocols (LCP, IPCP, and IPV6CP) using timer setup(). When detach hdlc protocol() frees this memory via kfree(), it fails to synchronize these timers because the PPP protocol lacked a .detach callback. Consequently, a ppp timer callback that is already executing can survive the memory free and subsequently dereference proto->state or ppp->lock in freed memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-63803

Affected Products

Linux Kernel

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-63803 · Security Note
• https://git.kernel.org/stable/c/c64dbef1c0fbd36f9530aa75112acdf6a6d3cfd8 · Note
• https://git.kernel.org/stable/c/8308122bc9c065b1f376e081ed300129a2ac9545 · Note
• https://git.kernel.org/stable/c/5a84398101bf9f11e84b176343e4e3ba83e668c0 · Note
• https://git.kernel.org/stable/c/ce8f9ddca0c9f217342a8b49efd309aa35b81a36 · Note
• https://git.kernel.org/stable/c/508a0139d3bf60f6a03d2fbfb63a89a9463d983a · Note
• https://git.kernel.org/stable/c/a594debfd4e7ec39413647458907f689ef57fd2f · Note
• https://git.kernel.org/stable/c/c78a4e41ab5ead6193ad8a2dd92e8906bae659fa · Note
• https://twitter.com/VulmonFeeds/status/2078917639745744925 · Twitter Post