PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-26671 Linux CVE debrief

A race condition in the Linux kernel's block multi-queue (blk-mq) subsystem can cause I/O operations to hang indefinitely. The vulnerability stems from a synchronization issue in the sbitmap (sparse bitmap) wakeup mechanism used for managing I/O request tags. When the race condition triggers, pending I/O requests may never be processed, leading to system unavailability or degraded performance in storage-dependent workloads. The issue has been resolved in the Linux kernel with a fix to the blk-mq sbitmap wakeup logic.

Vendor
Linux
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

System administrators managing Linux-based industrial networking equipment, particularly Siemens SCALANCE and RUGGEDCOM product families; security teams responsible for OT/ICS infrastructure; organizations running storage-intensive workloads on Linux kernels with blk-mq enabled

Technical summary

The vulnerability exists in the Linux kernel's block multi-queue (blk-mq) I/O scheduling subsystem. A race condition in the sparse bitmap (sbitmap) wakeup mechanism can prevent proper wake-up of I/O request processing, causing indefinite hangs. The sbitmap is used to allocate and manage tags for I/O requests; when the wakeup race occurs, threads waiting for available tags may never be signaled, resulting in stalled I/O operations. This affects systems using blk-mq for NVMe, SCSI, or other block devices. The fix resolves the synchronization issue in the sbitmap wakeup path to ensure reliable I/O completion.

Defensive priority

medium

Recommended defensive actions

  • Verify Linux kernel version and apply vendor-provided patches if running affected Siemens industrial networking products
  • Review storage subsystem logs for unexplained I/O latency or hang conditions
  • Monitor for kernel updates addressing blk-mq race conditions in sbitmap wakeup handling
  • Consult Siemens ProductCERT advisory SSA-613116 for definitive product impact assessment
  • Implement defense-in-depth strategies for industrial control systems per CISA guidance

Evidence notes

The source advisory (ICSA-25-226-15) indicates this CVE was initially included in the affected products list but was subsequently moved to 'Known Not Affected Products' per the revision history dated 2026-02-12. The threat category is marked as 'Misinformed' in the source data, suggesting the initial assessment of impact was incorrect. The advisory was republished on 2026-02-25 based on Siemens ProductCERT SSA-613116.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-26671 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-26671

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-26671 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-26671

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.