---
id: CVE-2023-54120
title: 'Bluetooth: Fix race condition in hidp_session_thread'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: Fix race condition in hidp_session_thread

  There is a potential race condition in hidp_session_thread that may
  lead to use-after-free. For instance, the time…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    152f47bd6b995e0e98c85672f6d19894bc287ef2
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    5f3d214d19899183d4e0cce7552998262112e4ab
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    8a99e6200c38b78a45dcd12a6bdc43fdf4dc36be
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    f7ec5ca433ceead8d9d78fd2febff094f289441d
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    0efb276d5848a3accc37c6f41b85e442c4768169
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    f6719fd8f409fa1da8dc956e93822d25e1e8b360
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    248af9feca062a4ca9c3f2ccf67056c8a5eb817f
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    c95930abd687fcd1aa040dc4fe90dff947916460
  - Linux 2.6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:38:39.186445Z'
published: '2025-12-24'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:41:40.191Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-54120'
references:
  - url: 'https://git.kernel.org/stable/c/152f47bd6b995e0e98c85672f6d19894bc287ef2'
  - url: 'https://git.kernel.org/stable/c/5f3d214d19899183d4e0cce7552998262112e4ab'
  - url: 'https://git.kernel.org/stable/c/8a99e6200c38b78a45dcd12a6bdc43fdf4dc36be'
  - url: 'https://git.kernel.org/stable/c/f7ec5ca433ceead8d9d78fd2febff094f289441d'
  - url: 'https://git.kernel.org/stable/c/0efb276d5848a3accc37c6f41b85e442c4768169'
  - url: 'https://git.kernel.org/stable/c/f6719fd8f409fa1da8dc956e93822d25e1e8b360'
  - url: 'https://git.kernel.org/stable/c/248af9feca062a4ca9c3f2ccf67056c8a5eb817f'
  - url: 'https://git.kernel.org/stable/c/c95930abd687fcd1aa040dc4fe90dff947916460'
tags:
  - cve.org
epss: 0.00313
epssPercentile: 0.22534
ingestedAt: '2026-10-15T22:48:25.430Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix race condition in hidp_session_thread

There is a potential race condition in hidp_session_thread that may
lead to use-after-free. For instance, the timer is active while
hidp_del_timer is called in hidp_session_thread(). After hidp_session_put,
then 'session' will be freed, causing kernel panic when hidp_idle_timeout
is running.

The solution is to use del_timer_sync instead of del_timer.

Here is the call trace:

? hidp_session_probe+0x780/0x780
call_timer_fn+0x2d/0x1e0
__run_timers.part.0+0x569/0x940
hidp_session_probe+0x780/0x780
call_timer_fn+0x1e0/0x1e0
ktime_get+0x5c/0xf0
lapic_next_deadline+0x2c/0x40
clockevents_program_event+0x205/0x320
run_timer_softirq+0xa9/0x1b0
__do_softirq+0x1b9/0x641
__irq_exit_rcu+0xdc/0x190
irq_exit_rcu+0xe/0x20
sysvec_apic_timer_interrupt+0xa1/0xc0

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 152f47bd6b995e0e98c85672f6d19894bc287ef2`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5f3d214d19899183d4e0cce7552998262112e4ab`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8a99e6200c38b78a45dcd12a6bdc43fdf4dc36be`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f7ec5ca433ceead8d9d78fd2febff094f289441d`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0efb276d5848a3accc37c6f41b85e442c4768169`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f6719fd8f409fa1da8dc956e93822d25e1e8b360`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 248af9feca062a4ca9c3f2ccf67056c8a5eb817f`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c95930abd687fcd1aa040dc4fe90dff947916460`
- `Linux 2.6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.