Skip to main content

Over 150 LLM Providers · Over 5,300 Models The most extensible AI-powered pentesting platform. Open source. Star on GitHub

CVE-2023-54120

8.8 · HIGH
Published Dec 24, 2025 EPSS 0.30% (23th pctl)

Overview

CVE-2023-54120 is a high-severity vulnerability. It was published on December 24, 2025 and has a CVSS 3.1 base score of 8.8 (HIGH).

This vulnerability has a CVSS 3.1 base score of 8.8, rated HIGH. It requires local or adjacent network access to exploit. No authentication or special privileges are required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix race condition in hidp_session_thread

There is a potential race condition in hidp_session_thread that may

lead to use-after-free. For instance, the timer is active while

hidp_del_timer is called in hidp_session_thread(). After hidp_session_put,

then 'session' will be freed, causing kernel panic when hidp_idle_timeout

is running.

The solution is to use del_timer_sync instead of del_timer.

Here is the call trace:

? hidp_session_probe+0x780/0x780

call_timer_fn+0x2d/0x1e0

__run_timers.part.0+0x569/0x940

hidp_session_probe+0x780/0x780

call_timer_fn+0x1e0/0x1e0

ktime_get+0x5c/0xf0

lapic_next_deadline+0x2c/0x40

clockevents_program_event+0x205/0x320

run_timer_softirq+0xa9/0x1b0

__do_softirq+0x1b9/0x641

__irq_exit_rcu+0xdc/0x190

irq_exit_rcu+0xe/0x20

sysvec_apic_timer_interrupt+0xa1/0xc0

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Ref git.kernel.org/stable/c/0efb276d5848a3accc37c6f41b85e442c4768169 Ref git.kernel.org/stable/c/152f47bd6b995e0e98c85672f6d19894bc287ef2 Ref git.kernel.org/stable/c/248af9feca062a4ca9c3f2ccf67056c8a5eb817f Ref git.kernel.org/stable/c/5f3d214d19899183d4e0cce7552998262112e4ab Ref git.kernel.org/stable/c/8a99e6200c38b78a45dcd12a6bdc43fdf4dc36be Ref git.kernel.org/stable/c/c95930abd687fcd1aa040dc4fe90dff947916460 Ref git.kernel.org/stable/c/f6719fd8f409fa1da8dc956e93822d25e1e8b360 Ref git.kernel.org/stable/c/f7ec5ca433ceead8d9d78fd2febff094f289441d

Frequently Asked Questions

What is CVE-2023-54120?

CVE-2023-54120 is a high-severity vulnerability. It was published on December 24, 2025 and has a CVSS 3.1 base score of 8.8 (HIGH).

How severe is CVE-2023-54120?

This vulnerability has a CVSS 3.1 base score of 8.8, rated HIGH. It requires local or adjacent network access to exploit. No authentication or special privileges are required for exploitation.

How do I fix or remediate CVE-2023-54120?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2023-54120?

CyberStrike's AI-powered security agents can automatically detect CVE-2023-54120 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.
Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.
Code Review

AI-driven PR review catches vulnerable dependencies before they ship.
HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related HIGH CVEs from 2023

View all →
8.9
CVE-2022-4428

support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation whic

8.9
CVE-2023-26032

ZoneMinder is a free, open source Closed-circuit television software application for Linux which sup

8.9
CVE-2023-26037

ZoneMinder is a free, open source Closed-circuit television software application for Linux which sup

8.9
CVE-2023-26480

XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights c

8.9
CVE-2023-29207

XWiki Commons are technical libraries common to several other top level XWiki projects. The Livetab

8.9
CVE-2023-29508

XWiki Commons are technical libraries common to several other top level XWiki projects. A user witho

8.9
CVE-2023-27524

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that

8.9
CVE-2023-33961

Leantime is a lean open source project management system. Starting in version 2.3.21, an authenticat

8.9
CVE-2023-30435

IBM Security Guardium 11.3, 11.4, and 11.5 is vulnerable to stored cross-site scripting. This vulner

8.9
CVE-2023-39446

Thanks to the weaknesses that the web application has at the user management level, an attack

8.9
CVE-2023-42819

JumpServer is an open source bastion host. Logged-in users can access and modify the contents of any

8.9
CVE-2023-46723

lte-pic32-writer is a writer for PIC32 devices. In versions 0.0.1 and prior, those who use `sendto.t

Browse by year 2026 2025 2024 2023 2022 2021 2020 2019 2018 2017 2016 2015 2014 2013 2012 2011 2010 2009 2008 2007 2006 2005 2004 2003 2002 2001 2000 1999