CVE-2024-24860

What it actually does

Race condition in bluetooth driver min/max_key_size_set functions allows concurrent access leading to null pointer dereference and kernel panic or denial of service.

Why it matters to the business

Systems relying on Bluetooth connectivity face unexpected crashes or loss of service availability, increasing downtime risk especially on devices with high Bluetooth usage; widespread kernel exposure amplifies operational disruption across fleets.

How an attack unfolds

An attacker on the local network or adjacent to the device triggers concurrent calls to key size setter functions in the Bluetooth stack to induce the race, dereference a null pointer, and force a kernel panic resulting in denial of service; no remote code execution or privilege escalation occurs.

How to fix it

Upgrade snapd to version 2.62-1 on Debian 13 or apply the kernel-level fix corresponding to commit b749eda44d9f849855587dbd392571adac32e928 in snapcore/snapd; disable Bluetooth when not required as a temporary control.

How to confirm the fix worked

Confirm snapd package version meets or exceeds the fixed release, verify Bluetooth driver functions no longer contain the race condition via source inspection or kernel patch level, and test that concurrent key size operations no longer produce null dereferences.

Typical attack path

1. Gain adjacency on the same network or physical proximity to target Bluetooth device
2. Issue rapid or concurrent Bluetooth pairing or key size configuration requests to hit the race window
3. Trigger null pointer dereference causing kernel panic and system reboot or hang

How to detect it

Review kernel logs for Bluetooth-related null pointer dereference oops or panic messages; correlate with unusual Bluetooth pairing activity or key size configuration attempts in system audit logs.

What your security team should do

• Apply the listed snapd and kernel fixes immediately on all affected systems
• Prioritize patching for any exposed Bluetooth-enabled hosts given the stable EPSS and long public disclosure window
• Disable Bluetooth services where not operationally required
• Monitor for kernel oops or panic events tied to Bluetooth drivers