Executive brief
The Linux kernel's Bluetooth HID profile (HIDP) implementation contains a race condition in the session thread that can cause a kernel panic. When a timer is cancelled while still active, the underlying session data structure may be freed prematurely, causing the timer callback to access freed memory and crash the system. This affects systems with Bluetooth devices, particularly HID devices like keyboards and mice.
Technical details
A use-after-free race condition exists in the hidp_session_thread function in net/bluetooth/hidp/core.c. The vulnerability occurs when hidp_del_timer() calls del_timer() while the idle timeout timer is still running; after hidp_session_put() frees the session structure, the timer callback (hidp_idle_timeout) may still execute and access the freed memory, triggering a kernel panic. The fix replaces del_timer() with del_timer_sync(), which blocks until the timer callback completes before returning, ensuring the session structure remains valid during callback execution. This is a local denial-of-service issue affecting systems with active Bluetooth HID connections.
Affected products
- Linux Linux kernel Multiple versions; patch available
Timeline
- 2023-03-04: disclosed: Fix authored
- 2023-04-20: patched: Merged into stable kernel releases
- 2025-12-24: advisory