In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
In btsdioprobe, the data->work is bound with btsdiowork. It will be started in btsdiosendframe.
If the btsdioremove runs with a unfinished work, there may be a race condition that hdev is freed but used in btsdiowork. Fix it by canceling the work before do cleanup in btsdio_remove.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53145.json"
}