{"id":"CVE-2023-54120","summary":"Bluetooth: Fix race condition in hidp_session_thread","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Fix race condition in hidp_session_thread\n\nThere is a potential race condition in hidp_session_thread that may\nlead to use-after-free. For instance, the timer is active while\nhidp_del_timer is called in hidp_session_thread(). After hidp_session_put,\nthen 'session' will be freed, causing kernel panic when hidp_idle_timeout\nis running.\n\nThe solution is to use del_timer_sync instead of del_timer.\n\nHere is the call trace:\n\n? hidp_session_probe+0x780/0x780\ncall_timer_fn+0x2d/0x1e0\n__run_timers.part.0+0x569/0x940\nhidp_session_probe+0x780/0x780\ncall_timer_fn+0x1e0/0x1e0\nktime_get+0x5c/0xf0\nlapic_next_deadline+0x2c/0x40\nclockevents_program_event+0x205/0x320\nrun_timer_softirq+0xa9/0x1b0\n__do_softirq+0x1b9/0x641\n__irq_exit_rcu+0xdc/0x190\nirq_exit_rcu+0xe/0x20\nsysvec_apic_timer_interrupt+0xa1/0xc0","modified":"2026-03-20T12:33:27.417764Z","published":"2025-12-24T13:06:40.420Z","related":["SUSE-SU-2026:0263-1","SUSE-SU-2026:0316-1","SUSE-SU-2026:0317-1","SUSE-SU-2026:0411-1","SUSE-SU-2026:0617-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54120.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0efb276d5848a3accc37c6f41b85e442c4768169"},{"type":"WEB","url":"https://git.kernel.org/stable/c/152f47bd6b995e0e98c85672f6d19894bc287ef2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/248af9feca062a4ca9c3f2ccf67056c8a5eb817f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5f3d214d19899183d4e0cce7552998262112e4ab"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8a99e6200c38b78a45dcd12a6bdc43fdf4dc36be"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c95930abd687fcd1aa040dc4fe90dff947916460"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f6719fd8f409fa1da8dc956e93822d25e1e8b360"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f7ec5ca433ceead8d9d78fd2febff094f289441d"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54120.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54120"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2"},{"fixed":"152f47bd6b995e0e98c85672f6d19894bc287ef2"},{"fixed":"5f3d214d19899183d4e0cce7552998262112e4ab"},{"fixed":"8a99e6200c38b78a45dcd12a6bdc43fdf4dc36be"},{"fixed":"f7ec5ca433ceead8d9d78fd2febff094f289441d"},{"fixed":"0efb276d5848a3accc37c6f41b85e442c4768169"},{"fixed":"f6719fd8f409fa1da8dc956e93822d25e1e8b360"},{"fixed":"248af9feca062a4ca9c3f2ccf67056c8a5eb817f"},{"fixed":"c95930abd687fcd1aa040dc4fe90dff947916460"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-54120.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.12"},{"fixed":"4.14.313"}]},{"type":"ECOSYSTEM","events":[{"introduced":"4.15.0"},{"fixed":"4.19.281"}]},{"type":"ECOSYSTEM","events":[{"introduced":"4.20.0"},{"fixed":"5.4.241"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.10.178"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.108"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.25"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.2.12"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-54120.json"}}],"schema_version":"1.7.5"}