ExpressionEngine natively processes forms in secure mode which means each for submission is tied to an automatically generated XID / Hash which is passed as a hidden field in all CP and most front-end forms.
The XID is a hash containing a reference to a database entry which gives EE a bunch of info about the user (their user agent, timestamp created, ip address and some other identifying 'stuff').
The XID is validated on submission (to ensure the same user visiting the form is the same user submitting the form) so if the XID fails to validate, or expires - EE will block the submission and in the case of a user being in the CP, it simply redirects them to the home page which isn't very helpful.
To prevent your issue, you can disable secure form processing globally via:
Admin -> Security and Session Preferences -> Process form data in Secure Mode? -> No
I'm always quite wary of disabling this though, if you do - proceed with caution. You're opening a few holes and it's up to you to determine if the risk is worth it.
EDIT: I should also mention that a common cause of what you are describing is a user submitting a form and using their browser's back button to submit again. Because the XID has been used, it is no longer 'valid' and EE will reject it.