CVE-2023-54120 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: Fix race condition in hidp_session_thread
There is a potential race condition in hidp_session_thread that may lead to use-after-free. For instance, the timer is active while hidp_del_timer is called in hidp_session_thread(). After hidp_session_put, then 'session' will be freed, causing kernel panic when hidp_idle_timeout is running.
The solution is to use del_timer_sync instead of del_timer.
Here is the call trace:
? hidp_session_probe+0x780/0x780 call_timer_fn+0x2d/0x1e0 __run_timers.part.0+0x569/0x940 hidp_session_probe+0x780/0x780 call_timer_fn+0x1e0/0x1e0 ktime_get+0x5c/0xf0 lapic_next_deadline+0x2c/0x40 clockevents_program_event+0x205/0x320 run_timer_softirq+0xa9/0x1b0 __do_softirq+0x1b9/0x641 __irq_exit_rcu+0xdc/0x190 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0xa1/0xc0
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/03/2026
The vulnerability CVE-2023-54120 represents a critical race condition within the Linux kernel's Bluetooth HID protocol implementation specifically affecting the hidp_session_thread functionality. This issue manifests as a use-after-free condition that can lead to kernel panic and system instability. The flaw occurs when timing mechanisms interact improperly with session lifecycle management, creating a scenario where memory deallocation happens before all references to that memory are cleared. The vulnerability is particularly dangerous because it operates at the kernel level where such issues can compromise entire system operations and potentially provide attackers with privilege escalation opportunities.
The technical root cause stems from improper timer management within the Bluetooth HID protocol handler. When hidp_del_timer is invoked while a timer is still active, and subsequent to hidp_session_put being called, the session structure gets freed while another execution path might still be referencing it. This creates a classic race condition scenario where the timing of memory deallocation conflicts with ongoing operations that expect the memory to remain valid. The call trace reveals the problematic execution path where timer functions are invoked after session cleanup has begun, leading to access of freed memory. This pattern aligns with CWE-367, which describes Time-of-Check to Time-of-Use (TOCTOU) vulnerabilities, though specifically manifesting as a use-after-free condition.
The operational impact of this vulnerability extends beyond simple system crashes to potentially enable more sophisticated attacks. When a kernel panic occurs due to this race condition, it can provide an attacker with opportunities to exploit the system's instability for privilege escalation or denial-of-service attacks. The timing aspect makes this particularly challenging to reproduce and detect, as it depends on precise synchronization between multiple kernel threads and timer events. The vulnerability affects systems running Linux kernels with Bluetooth HID support, making it relevant to a wide range of devices including laptops, desktops, servers, and embedded systems that utilize Bluetooth input devices.
Mitigation strategies should focus on implementing the recommended fix of replacing del_timer with del_timer_sync throughout the hidp_session_thread implementation. This change ensures that timer deletion operations complete before returning control to the calling function, eliminating the race condition window. System administrators should prioritize kernel updates to versions containing this fix, particularly in environments where Bluetooth HID devices are actively used. Additional defensive measures include monitoring for kernel panic events and implementing proper system hardening practices to limit potential exploitation vectors. Organizations should also consider implementing network segmentation to reduce the attack surface where Bluetooth interfaces are exposed, aligning with ATT&CK technique T1059.001 for command and scripting interpreter usage and T1566 for credential harvesting through network services. The fix addresses the underlying synchronization issue while maintaining backward compatibility with existing Bluetooth HID functionality.