PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-36894 Linux CVE debrief

This CVE addresses a race condition vulnerability in the Linux kernel's USB gadget subsystem, specifically within the Function Filesystem (f_fs) driver. The vulnerability involves a race between `aio_cancel()` and AIO request completion operations. According to the source advisory, this vulnerability has been assessed as **Misinformed** for the Siemens products listed, indicating that the products are not actually affected by this vulnerability despite initial inclusion in the advisory. The advisory was initially published on 2025-08-12 and subsequently modified on 2026-02-25 to correct the list of affected products, moving entries to the Known Not Affected Products category.

Vendor
Linux
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, or SCALANCE XCM-/XRM-/XCH-/XRH-300 family industrial networking equipment should verify their firmware status against vendor advisories, though this specific CVE is assessed as not affecting these products.

Technical summary

The vulnerability exists in the Linux kernel's USB gadget Function Filesystem (f_fs) driver where a race condition can occur between asynchronous I/O cancellation (`aio_cancel()`) and AIO request completion. This type of race condition typically manifests as use-after-free or double-free memory corruption scenarios. However, per the source advisory's threat assessment, this vulnerability has been categorized as 'Misinformed' for the Siemens products originally listed, indicating that upon further analysis, the products are not actually vulnerable to this issue. The advisory covering Siemens SINEC OS and related industrial networking products was updated on 2026-02-25 to reflect this corrected assessment.

Defensive priority

low

Recommended defensive actions

  • Verify that affected Siemens product configurations are updated to the latest firmware versions as specified in vendor security advisories
  • Review network segmentation for industrial control systems to limit exposure of USB gadget interfaces
  • Monitor vendor security advisories for any reassessment of this vulnerability's impact
  • Apply standard defense-in-depth practices for industrial control systems per CISA guidance

Evidence notes

The source advisory (ICSA-25-226-07) explicitly marks this CVE with threat category 'impact' and details 'Misinformed' for product IDs CSAFPID-0006, CSAFPID-0002, and CSAFPID-0003. The revision history indicates corrections were made on 2026-02-12 to move entries from Affected Products to Known Not Affected Products.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-36894 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-36894

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-36894 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-36894

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.