In the Linux kernel, the following vulnerability has been resolved: hdlc_ppp: sync per-proto timers before freeing hdlc state Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp registers a timer via timer_setup(). That struct ppp is the hdlc->state allocation, which detach_hdlc_protocol() frees with kfree() in both teardown paths: unregister_hdlc_device() and the re-attach inside attach_hdlc_protocol(). The ppp proto never registered a .detach callback, so detach_hdlc_protocol() performs no timer synchronization before the kfree(). The only cancel, timer_delete(&proto->timer) in ppp_cp_event(), is partial (it does not wait for a running callback) and only runs on the ->CLOSED transition; ppp_stop()/ppp_close() do not sync either. A ppp_timer callback already executing (blocked on ppp->lock) survives the kfree and then dereferences proto->state / ppp->lock in freed memory, leading to a use-after-free. Fix this by adding a .detach helper that calls timer_shutdown_sync
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-63803 is a use-after-free vulnerability in the Linux kernel's HDLC PPP implementation where per-protocol timers (LCP/IPCP/IPV6CP) embedded within the ppp structure are not properly synchronized before the parent hdlc state is freed. When detach_hdlc_protocol() calls kfree() on the hdlc allocation during device teardown or protocol re-attachment, active timers referencing the freed memory can still fire, leading to kernel memory corruption and potential code execution. This affects Linux systems using HDLC PPP protocol handlers, particularly in networking infrastructure, telecommunications equipment, and systems with legacy WAN configurations. The vulnerability is particularly dangerous because the timing window between deallocation and timer expiration is unpredictable, making it difficult to detect through normal testing.
Casky's platform would detect exploitation patterns related to this vulnerability by mapping behaviors to kernel memory safety and resource management techniques within MITRE ATT&CK. Practitioners would identify suspicious patterns including: abnormal kernel memory access violations (relating to T1040 Traffic Capture and T1563 Exploit Remote Services), unexpected process termination or kernel crashes following HDLC protocol operations, and memory corruption artifacts in kernel logs. Extended reasoning across Casky's 754 mapped security skills would correlate HDLC protocol manipulation with resource exhaustion tactics and privilege escalation attempts, revealing indicators that an attacker is attempting to trigger the use-after-free condition. Detection would focus on monitoring kernel module loading/unloading sequences, HDLC device attach/detach operations, and abnormal timer behavior patterns that precede system instability.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-63803. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation