{"id":"CVE-2023-54120","title":"Bluetooth: Fix race condition in hidp_session_thread","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix race condition in hidp_session_thread\n\nThere is a potential race condition in hidp_session_thread that may\nlead to use-after-free. For instance, the time…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 152f47bd6b995e0e98c85672f6d19894bc287ef2","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5f3d214d19899183d4e0cce7552998262112e4ab","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8a99e6200c38b78a45dcd12a6bdc43fdf4dc36be","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f7ec5ca433ceead8d9d78fd2febff094f289441d","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0efb276d5848a3accc37c6f41b85e442c4768169","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f6719fd8f409fa1da8dc956e93822d25e1e8b360","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 248af9feca062a4ca9c3f2ccf67056c8a5eb817f","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c95930abd687fcd1aa040dc4fe90dff947916460","Linux 2.6.12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:38:39.186445Z"},"published":"2025-12-24","updated":"2026-10-15","sourceUpdated":"2026-10-15T21:41:40.191Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-54120","references":[{"url":"https://git.kernel.org/stable/c/152f47bd6b995e0e98c85672f6d19894bc287ef2"},{"url":"https://git.kernel.org/stable/c/5f3d214d19899183d4e0cce7552998262112e4ab"},{"url":"https://git.kernel.org/stable/c/8a99e6200c38b78a45dcd12a6bdc43fdf4dc36be"},{"url":"https://git.kernel.org/stable/c/f7ec5ca433ceead8d9d78fd2febff094f289441d"},{"url":"https://git.kernel.org/stable/c/0efb276d5848a3accc37c6f41b85e442c4768169"},{"url":"https://git.kernel.org/stable/c/f6719fd8f409fa1da8dc956e93822d25e1e8b360"},{"url":"https://git.kernel.org/stable/c/248af9feca062a4ca9c3f2ccf67056c8a5eb817f"},{"url":"https://git.kernel.org/stable/c/c95930abd687fcd1aa040dc4fe90dff947916460"}],"tags":["cve.org"],"epss":0.00313,"epssPercentile":0.22534,"ingestedAt":"2026-10-15T22:48:25.430Z","slug":"CVE-2023-54120","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix race condition in hidp_session_thread\n\nThere is a potential race condition in hidp_session_thread that may\nlead to use-after-free. For instance, the timer is active while\nhidp_del_timer is called in hidp_session_thread(). After hidp_session_put,\nthen 'session' will be freed, causing kernel panic when hidp_idle_timeout\nis running.\n\nThe solution is to use del_timer_sync instead of del_timer.\n\nHere is the call trace:\n\n? hidp_session_probe+0x780/0x780\ncall_timer_fn+0x2d/0x1e0\n__run_timers.part.0+0x569/0x940\nhidp_session_probe+0x780/0x780\ncall_timer_fn+0x1e0/0x1e0\nktime_get+0x5c/0xf0\nlapic_next_deadline+0x2c/0x40\nclockevents_program_event+0x205/0x320\nrun_timer_softirq+0xa9/0x1b0\n__do_softirq+0x1b9/0x641\n__irq_exit_rcu+0xdc/0x190\nirq_exit_rcu+0xe/0x20\nsysvec_apic_timer_interrupt+0xa1/0xc0\n\n## Affected\n\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 152f47bd6b995e0e98c85672f6d19894bc287ef2`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5f3d214d19899183d4e0cce7552998262112e4ab`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8a99e6200c38b78a45dcd12a6bdc43fdf4dc36be`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f7ec5ca433ceead8d9d78fd2febff094f289441d`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0efb276d5848a3accc37c6f41b85e442c4768169`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f6719fd8f409fa1da8dc956e93822d25e1e8b360`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 248af9feca062a4ca9c3f2ccf67056c8a5eb817f`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c95930abd687fcd1aa040dc4fe90dff947916460`\n- `Linux 2.6.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}