CVE-2024-42133

MediumCVSS 5.5

Published: 30/07/2024(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

In the Linux kernel, a vulnerability in the Bluetooth stack allows too large handle values in BIG to cause erroneous release of an IDA identifier in hci_conn_cleanup.

Risk Assessment

This could lead to system instability or potential privilege escalation via manipulation of Bluetooth connections.

Recommendation

Apply the Linux kernel patch that fixes this issue (commit in the Bluetooth subsystem).

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Ignore too large handle values in BIG hci_le_big_sync_established_evt is necessary to filter out cases where the handle value is belonging to ida id range, otherwise ida will be erroneously released in hci_conn_cleanup.