# CVE-2024-24857: Linux Kernel race condition in Bluetooth device driver

Source: https://junglewise.ai/threats/cve-2024-24857-linux-kernel-race-condition-in-bluetooth-device-driver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-02-05. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2024-24857 · Severity: medium · CVSS 4.6 · Published 2024-02-05

A race condition exists in the Linux kernel's Bluetooth driver, which manages wireless connections between devices. An attacker with physical proximity or local network access could exploit this flaw to disrupt Bluetooth services. This may result in connection failures or a complete denial of service, impacting the reliability of wireless communication on affected systems.

Technologies: [Debian Linux](https://junglewise.ai/threats/technologies/debian), [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem](https://junglewise.ai/threats/technologies/simatic-s7-1500-tm-mfp-gnu-linux-subsystem). Vendors: [Debian](https://junglewise.ai/threats/vendors/debian), [Linux](https://junglewise.ai/threats/vendors/linux), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2024-24857 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-24857 being exploited in the wild.

**How severe is CVE-2024-24857?** Medium severity, with a CVSS score of 4.6, published 5 February 2024.

**Which products and versions are affected?** Debian Linux 10.0; Linux Kernel 3.19.8, 6.0 to 6.7.2, 6.8-rc1; Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem All versions.

**Is there a fix for CVE-2024-24857?** A patch was published on 2024-06-25: Debian LTS security update released for kernel 5.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-24857 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-2024-24857?** Check whether you run Debian Linux, Linux Kernel or Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A race condition was identified in the net/bluetooth device driver within the conn_info_{min,max}_age_set() functions. The vulnerability stems from improper synchronization when accessing shared resources, which can trigger an integer overflow (CWE-190). An attacker with high privileges and adjacent network access could exploit this during specific user interactions to cause a denial of service or compromise data integrity. Patches have been released for various Linux distributions, including Debian 10 (buster) in versions 4.19.316-1 and 5.10.216-1~deb10u1.

## Affected products

- Linux Linux Kernel 3.19.8, 6.0 to 6.7.2, 6.8-rc1
- Debian Debian Linux 10.0
- Siemens SIMATIC S7-1500 TM MFP GNU/Linux subsystem All versions

## Timeline

- 2024-02-05: disclosed: Initial disclosure by OpenAnolis
- 2024-02-05: advisory: NVD published date
- 2024-06-25: patched: Debian LTS security update released for kernel 5.10
- 2024-06-27: patched: Debian LTS security update released for kernel 4.19

## References

- [https://bugzilla.openanolis.cn/show_bug.cgi?id=8155](https://bugzilla.openanolis.cn/show_bug.cgi?id=8155)
- [https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html](https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html)
- [https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html](https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html)
- [https://cert-portal.siemens.com/productcert/html/ssa-265688.html](https://cert-portal.siemens.com/productcert/html/ssa-265688.html)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)