CVE-2024-24859

What it actually does

Race condition in net/bluetooth sniff_{min,max}_interval_set() allows an attacker to trigger a Bluetooth sniffing exception resulting in denial of service.

Why it matters to the business

Service disruption on systems handling Bluetooth connections, with elevated urgency for environments running affected snapd versions due to long disclosure window and stable exploit probability.

How an attack unfolds

An attacker with high-privileged adjacent access races the interval-set functions in the Bluetooth stack to induce an exception state; the listed Android kernel actor context is unrelated to this denial-of-service issue.

How to fix it

Upgrade snapd to 2.62-1 on Debian 13 or apply the canonical/snapd commit b66fee81606a1c05f965a876ccbaf44174194063; rebuild and redeploy any dependent packages.

How to confirm the fix worked

Confirm snapd version is at or above the listed fixed releases and verify Bluetooth stack no longer exhibits the race condition via kernel regression tests.

Typical attack path

1. Gain adjacent network or local high-privileged access to a system using the vulnerable Bluetooth stack
2. Trigger concurrent calls to sniff_min_interval_set and sniff_max_interval_set
3. Induce the race window that produces the sniffing exception
4. Cause repeated exceptions leading to denial of service

How to detect it

Review system logs for Bluetooth stack exceptions around sniff interval operations; no public exploitation artifacts are associated with this issue.

What your security team should do

• Apply the fixed snapd versions immediately on all affected Debian and Git-based deployments
• Monitor upstream kernel Bluetooth changes for related fixes
• Review Bluetooth exposure and restrict adjacent access where possible