Към съдържанието
Търсене

CVE-2026-63803: Linux, грешка в паметта

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: hdlc_ppp: sync per-proto timers before freeing hdlc state Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp registers a timer via timer_setup(). That struct ppp is the hdlc->state allocation, which detach_hdlc_protocol() frees with kfree() in both teardown paths: unregister_hdlc_device() and the re-attach inside attach_hdlc_protocol(). The ppp proto never registered a .detach callback, so detach_hdlc_protocol() performs no timer synchronization before the kfree(). The only cancel, timer_delete(&proto->timer) in ppp_cp_event(), is partial (it does not wait for a running callback) and only runs on the ->CLOSED transition; ppp_stop()/ppp_close() do not sync either. A ppp_timer callback already executing (blocked on ppp->lock) survives the kfree and then dereferences proto->state / ppp->lock in freed memory, leading to a use-after-free. Fix this by adding a .detach helper that calls timer_shutdown_sync() on every per-proto timer. detach_hdlc_protocol() invokes proto->detach(dev) before kfree(hdlc->state), so timer_shutdown_sync() now runs on both free paths. timer_shutdown_sync() is used instead of timer_delete_sync() because the keepalive path re-arms the timer through add_timer()/mod_timer() and shutdown blocks any re-activation during teardown. Initialize the per-protocol timers in ppp_ioctl() when the protocol is attached, and remove the now-redundant timer_setup() from ppp_start(), so that the timers are initialized exactly once at attach time and ppp_timer_release() never operates on uninitialized timer_list structures. attach_hdlc_protocol() uses kmalloc() (not kzalloc), so struct ppp's protos[i].timer is uninitialized garbage until the first timer_setup(); without this init-at-attach, attaching the PPP protocol without ever bringing the device up would leave timer_shutdown_sync() operating on uninitialized memory in .detach. Moving the init out of ppp_start() (which only ru

Засегнати продукти

  • Linux Linux: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди 86d80a231bde4cfb64bfbfbfffd83056fc93628f; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди 8308122bc9c065b1f376e081ed300129a2ac9545; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди ce8f9ddca0c9f217342a8b49efd309aa35b81a36; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди 508a0139d3bf60f6a03d2fbfb63a89a9463d983a; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди c64dbef1c0fbd36f9530aa75112acdf6a6d3cfd8; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди 5a84398101bf9f11e84b176343e4e3ba83e668c0; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди a594debfd4e7ec39413647458907f689ef57fd2f; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 преди c78a4e41ab5ead6193ad8a2dd92e8906bae659fa
  • Linux Linux: 2.6.12; преди 2.6.12; 5.10.261 до 5.10.*; 5.15.211 до 5.15.*; 6.1.177 до 6.1.*; 6.6.144 до 6.6.*; 6.12.95 до 6.12.*; 6.18.38 до 6.18.*; 7.1.3 до 7.1.*; от 7.2 нататък

Вид слабост

История

  • 19 юли 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-63803: Linux, грешка в паметта | freedomonline.bg