PatchSiren cyber security CVE debrief

CVE-2024-26903 Linux CVE debrief

A null pointer dereference vulnerability exists in the Linux kernel's Bluetooth RFCOMM subsystem, specifically within the rfcomm_check_security function. This flaw can lead to a local denial-of-service condition when exploited by an authenticated attacker with low privileges. The vulnerability affects Siemens SIMATIC S7-1500 TM MFP industrial control systems that utilize the GNU/Linux subsystem, where Bluetooth functionality may be exposed. The issue was disclosed on April 9, 2024, and remains unpatched as of the latest advisory update. Organizations should implement access controls and trusted application policies to mitigate risk.

Vendor: Linux
Product: SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-04-09
Original CVE updated: 2026-05-14
Advisory published: 2024-04-09
Advisory updated: 2026-05-14

Who should care

Industrial control system operators, OT security teams, Siemens SIMATIC S7-1500 TM MFP administrators, manufacturing security engineers, and organizations with Bluetooth-enabled industrial endpoints.

Technical summary

The vulnerability resides in the rfcomm_check_security function within the Linux kernel's Bluetooth RFCOMM protocol implementation. A null pointer dereference occurs when processing security checks, leading to kernel panic and system crash. The attack requires local access and low privileges, with no user interaction needed. The CVSS 3.1 score of 5.5 reflects medium severity with high availability impact but no confidentiality or integrity effects. Siemens has confirmed no patch is currently available for the SIMATIC S7-1500 TM MFP GNU/Linux subsystem.

Defensive priority

medium

Recommended defensive actions

Restrict interactive shell access to the GNU/Linux subsystem to trusted personnel only
Implement application whitelisting to ensure only trusted applications are built and executed
Monitor for anomalous Bluetooth RFCOMM activity on affected systems
Apply vendor patches when Siemens releases updated firmware
Review CISA ICS recommended practices for defense-in-depth strategies

Evidence notes

CVE description confirms null-pointer dereference in rfcomm_check_security. CISA ICS advisory ICSA-24-102-01 identifies affected Siemens product. CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms local attack vector with availability impact. Advisory remediation section states 'Currently no fix is available' as of last modification.

Official resources

2024-04-09