PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-40987 Linux CVE debrief

This CVE describes a UBSAN (Undefined Behavior Sanitizer) warning in the Linux kernel's AMDGPU driver, specifically in the kv_dpm.c file related to dynamic power management for Kabini/Temash APUs. The source advisory (ICSA-25-226-07) marks this vulnerability as 'Misinformed' for the listed Siemens products, indicating the CVE was initially thought to affect these products but was later determined not to be applicable or was incorrectly attributed. The advisory was initially published on 2025-08-12 and underwent multiple revisions through 2026-02-25, including corrections to affected product lists and removal of rejected CVEs. No CVSS score or severity is available in the source data.

Vendor
Linux
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations running Siemens RUGGEDCOM or SCALANCE industrial networking equipment should verify this CVE is not applicable to their assets. Organizations using Linux systems with AMD Kabini/Temash APUs and AMDGPU drivers should monitor kernel security updates for the underlying UBSAN issue.

Technical summary

The vulnerability is a UBSAN (Undefined Behavior Sanitizer) warning in the Linux kernel's AMDGPU DRM driver, specifically in the kv_dpm.c file which handles dynamic power management for AMD Kabini and Temash APUs. UBSAN warnings indicate potential undefined behavior that could lead to instability or security issues. However, the source CISA advisory ICSA-25-226-07 explicitly marks this CVE's impact as 'Misinformed' for the listed Siemens industrial networking products (RUGGEDCOM RST2428P, SCALANCE XC/XR/XCM/XRM/XCH/XRH families), indicating the CVE does not actually affect these products. The advisory underwent multiple revisions between 2025-08-12 and 2026-02-25 to correct product attribution, with the final revision based on Siemens ProductCERT guidance.

Defensive priority

low

Recommended defensive actions

  • Verify asset inventory against affected product lists in source advisory to confirm non-applicability
  • Monitor Siemens ProductCERT SSA-355557 for any future clarifications
  • Review kernel update practices for Linux-based systems using AMDGPU drivers
  • Apply standard defense-in-depth practices for industrial control systems per CISA guidance

Evidence notes

Source advisory ICSA-25-226-07 explicitly categorizes impact as 'Misinformed' for all listed product IDs (CSAFPID-0006, CSAFPID-0002, CSAFPID-0003). The CVE description references a Linux kernel AMDGPU driver issue (drm/amdgpu: UBSAN warning in kv_dpm.c) which appears unrelated to the Siemens industrial networking products listed (RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, SCALANCE XCM-/XRM-/XCH-/XRH-300 family). The 2026-02-25 revision specifically notes this was a 'CISA Republication update based on Siemens ProductCERT SSA-355557 advisory', suggesting coordinated vendor clarification.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-40987 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-40987

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-40987 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-40987

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.