CVE-2023-54120: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54120 is a race condition vulnerability in the Linux kernel's Bluetooth HIDP (Human Interface Device Protocol) subsystem that can lead to a use-after-free condition and kernel panic. The flaw exists in hidp_session_thread(), where a timer may remain active when hidp_del_timer is called; after hidp_session_put frees the session object, a concurrently running hidp_idle_timeout can access the freed memory. The vulnerability affects Linux kernel versions across multiple stable branches and was publicly disclosed on December 24, 2025. It carries a CVSS v3.1 base score of 7.0 (High) (Red Hat CVE, Feedly).

The root cause is a race condition (CWE-362) combined with a use-after-free (CWE-416) in the Linux kernel's net/bluetooth/hidp/core.c. Specifically, hidp_session_thread() calls del_timer to cancel the idle timer before releasing the session reference via hidp_session_put; however, del_timer does not wait for a concurrently executing timer callback to finish, allowing hidp_idle_timeout to run against an already-freed session object. The fix replaces del_timer with del_timer_sync, which blocks until any in-progress timer callback completes before returning. Exploitation requires local access with low privileges and high attack complexity due to the timing-dependent nature of the race (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation can cause a kernel panic (denial of service) or, in a worst-case scenario, allow an attacker to execute arbitrary code in kernel context by leveraging the use-after-free condition. This could result in full compromise of the affected system's confidentiality, integrity, and availability. The scope is limited to the local system, but kernel-level code execution could enable privilege escalation and complete system takeover (Feedly, Red Hat CVE).

• Logs: Kernel panic or oops messages in /var/log/kern.log or dmesg output referencing hidp_session_thread, hidp_idle_timeout, or call_timer_fn in the call trace.
• Process/System Behavior: Unexpected system crashes or reboots on systems with active Bluetooth HIDP connections (e.g., Bluetooth HID devices such as keyboards or mice connected).
• Kernel Messages: Stack traces in dmesg matching the pattern: hidp_session_probe+0x780/0x780, call_timer_fn, __run_timers.part.0, run_timer_softirq, __do_softirq (Feedly).

Patches are available for multiple Linux kernel stable branches: 4.14.313, 4.19.281, 5.4.241, 5.10.178, 5.15.108, 6.1.25, 6.2.12, and 6.3. The fix replaces del_timer with del_timer_sync in hidp_session_thread() to eliminate the race condition. If immediate patching is not feasible, administrators should disable Bluetooth services where not critically required and restrict local user access to reduce the attack surface (Red Hat CVE, Red Hat Bugzilla).