PatchSiren cyber security CVE debrief
CVE-2024-24858 Linux CVE debrief
CVE-2024-24858 is a race condition in the Linux kernel Bluetooth stack that can disrupt I2CAP connection or broadcast behavior and may lead to denial of service. NVD rates it Medium severity (CVSS 4.6) and identifies affected Linux kernel ranges across multiple release lines.
- Vendor
- Linux
- Product
- Unknown
- CVSS
- MEDIUM 4.6
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2024-04-09
- Original CVE updated
- 2026-05-14
- Advisory published
- 2024-04-09
- Advisory updated
- 2026-05-14
Who should care
Linux distribution maintainers, embedded and OEM teams, and administrators running Bluetooth-enabled Linux systems should review this issue, especially where deployed kernels fall within the affected NVD version ranges.
Technical summary
The issue is described as a race condition in net/bluetooth {conn,adv}_{min,max}_interval_set() (CWE-362). According to NVD, vulnerable Linux kernel criteria include versions up to 3.19.8, 6.0 through 6.6.25, 6.7 through 6.7.12, and 6.8-rc1. The published CVSS v3.1 vector is AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:H, indicating an availability-focused impact with some integrity effect and higher attack complexity/privilege requirements.
Defensive priority
Medium
Recommended defensive actions
- Check deployed kernel versions against the NVD affected ranges before scheduling remediation.
- Apply vendor or distribution kernel updates that address the Bluetooth race condition when available.
- Review Bluetooth exposure on systems that do not require it and disable unused Bluetooth services or interfaces where operationally appropriate.
- After updating, reboot into the fixed kernel and validate Bluetooth and I2CAP functionality in normal workflows.
- Track downstream advisories for your platform, including Debian LTS and Siemens references listed in NVD, for deployment-specific guidance.
Evidence notes
This debrief is based on the supplied NVD record published on 2024-02-05 and modified on 2026-05-12. The NVD metadata provides the CVSS vector, CWE-362 classification, affected CPE criteria, and references to downstream advisories and a permissions-required bug tracker entry. No exploit details are included.
Sources and references
Verified primary and authoritative sources
-
CVE-2024-24858 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2024-24858
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2024-24858 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2024-24858
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
[email protected] - Third Party Advisory
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
[email protected] - Third Party Advisory
-
Source reference
Unverified legacy reference
URL: https://cert-portal.siemens.com/productcert/html/ssa-265688.html
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.