In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btsdio: fix use after free bug in btsdioremove due to unfinished work In btsdioprobe, &data->work was bound with btsdiowork.In btsdiosendframe, it was started by schedulework. If we call btsdio_remove with an unfinished job, there may be a race condition and cause UAF bug on hdev.