How severe is CVE-2024-24857?

CVE-2024-24857 has a CVSS 3.x base score of 4.6, rated medium severity. It is exploitable over an adjacent network with high attack complexity, requires high privileges and user interaction. Impact on confidentiality is none, integrity high, and availability low.

Is CVE-2024-24857 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-24857?

CVE-2024-24857 primarily affects Debian Debian Linux. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2024-24857?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-24857 have an EU (EUVD) identifier?

Yes. CVE-2024-24857 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-22220.

When was CVE-2024-24857 published?

CVE-2024-24857 was published on 2024-02-05 and last updated on 2026-06-17.

CVE-2024-24857

CVE-2024-24857 is a medium-severity vulnerability in Debian Debian Linux with a CVSS 3.x base score of 4.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-190.

Key facts

Severity: Medium (CVSS 3.x base score 4.6)
EPSS exploit prediction: 0% (23rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-22220
Weakness: CWE-190
Affected product: Debian Debian Linux
Published: 2024-02-05
Last modified: 2026-06-17

Description

A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.

Frequently asked questions

What is CVE-2024-24857?: A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.
How severe is CVE-2024-24857?: CVE-2024-24857 has a CVSS 3.x base score of 4.6, rated medium severity. It is exploitable over an adjacent network with high attack complexity, requires high privileges and user interaction. Impact on confidentiality is none, integrity high, and availability low.
Is CVE-2024-24857 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-24857?: CVE-2024-24857 primarily affects Debian Debian Linux. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2024-24857?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-24857 have an EU (EUVD) identifier?: Yes. CVE-2024-24857 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-22220.
When was CVE-2024-24857 published?: CVE-2024-24857 was published on 2024-02-05 and last updated on 2026-06-17.

References

Affected products (3)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*

More vulnerabilities in Debian Debian Linux

CVE-2025-32433 — Critical (CVSS 10.0): Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and…
CVE-2025-24201 — Critical (CVSS 10.0): An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in…
CVE-2024-42472 — Critical (CVSS 10.0): Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious…
CVE-2023-46604 — Critical (CVSS 10.0): The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote…
CVE-2022-30123 — Critical (CVSS 10.0): A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell…
CVE-2022-24884 — Critical (CVSS 10.0): ecdsautils is a tiny collection of programs used for ECDSA (keygen, sign, verify). `ecdsa_verify_[prepare_]legacy()`…

All CVEs affecting Debian Debian Linux →

Other CWE-190 (Integer Overflow or Wraparound) vulnerabilities

CVE-2026-4689 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was…
CVE-2026-24814 — Critical (CVSS 10.0): Integer Overflow or Wraparound vulnerability in swoole swoole-src (thirdparty/hiredis modules). This vulnerability is…
CVE-2025-64721 — Critical (CVSS 10.0): Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions…
CVE-2015-5108 — Critical (CVSS 10.0): Integer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC…
CVE-2015-5097 — Critical (CVSS 10.0): Integer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC…
CVE-2013-2555 — Critical (CVSS 10.0): Integer overflow in Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before…

Browse all CWE-190 (Integer Overflow or Wraparound) vulnerabilities →