The Linux kernel PPP implementation registers per‑protocol timers but does not synchronize them before freeing the PPP state during device teardown. If a timer callback is still executing when the state is freed, the callback dereferences memory that has already been released, resulting in a use‑after‑free. This can crash the kernel and take the host offline. The weakness is identified as CWE‑825.

All Linux kernel releases running the PPP subsystem and the hdlc_ppp module before the commit that added timer shutdown synchronisation. The vulnerability applies to any kernel version that includes the PPP control protocol timers without the .detach helper.

The CVSS score of 7.8 signals high severity, while the EPSS score of <1% indicates a low likelihood of exploitation in the wild. The vulnerability is not reported in CISA KEV, so no known exploit campaigns exist. Based on the description, the likely attack vector is a network‑based attacker sending crafted PPP packets to trigger a timer callback during device teardown; this inference is drawn from the requirement to activate a PPP protocol event during teardown. An attacker would need to trigger a PPP protocol event that causes a timer callback to be active while initiating device teardown, which can be achieved by sending crafted PPP packets or configuring PPP interfaces to be added and removed rapidly. Execution typically requires network access to the host or possibly local access if PPP interfaces are exposed.