PatchSiren cyber security CVE debrief

CVE-2024-40995 Linux CVE debrief

CVE-2024-40995 describes a possible infinite loop condition in the Linux kernel's network traffic control subsystem, specifically within the `tcf_idr_check_alloc()` function in `net/sched/act_api.c`. This vulnerability resides in the kernel's traffic classifier action API, which is used to manage packet filtering and traffic shaping rules. An infinite loop in this context could lead to a denial-of-service condition by causing a CPU hang when processing network traffic control operations. The vulnerability was initially published on August 12, 2025, and subsequently modified on February 25, 2026, as part of CISA's republication of Siemens ProductCERT advisory SSA-355557. Siemens has assessed this CVE as 'Misinformed' for its affected product lines, indicating that after analysis, the vulnerability does not actually impact the listed products as originally suspected. This determination was reached through Siemens' internal product security assessment process. The affected product scope has undergone revision, with the February 2026 updates clarifying configurations and removing several rejected CVEs from consideration. Organizations running Siemens industrial networking equipment should consult the vendor's official security advisory to confirm their specific product configurations and patch status.

Vendor: Linux
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

System administrators managing Linux-based network infrastructure with traffic control policies; security teams responsible for industrial control system (ICS) networks using Siemens networking equipment; kernel maintainers and distribution vendors packaging Linux kernels with net/sched support; network engineers implementing QoS or traffic shaping in critical infrastructure environments

Technical summary

The vulnerability exists in the Linux kernel's traffic control action API (`net/sched/act_api.c`). The `tcf_idr_check_alloc()` function manages IDR (integer ID management) allocations for traffic classifier actions. An infinite loop condition could be triggered during IDR allocation operations, potentially causing CPU exhaustion and denial of service. The IDR mechanism is used for mapping small integers to pointers in the kernel, and failures in this allocation path with improper error handling could lead to unbounded retry loops. This affects systems utilizing the `tc` (traffic control) utility for network QoS, traffic shaping, or packet filtering. Siemens has determined this vulnerability does not affect their listed industrial networking products (RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, SCALANCE XCM-/XRM-/XCH-/XRH-300 family) as originally suspected, classifying the CVE as 'Misinformed' for these products.

Defensive priority

medium

Recommended defensive actions

Verify current patch level against Siemens ProductCERT advisory SSA-355557 for specific product configurations
Review network traffic control (tc) rule configurations on Linux-based systems running traffic shaping or QoS policies
Monitor system CPU utilization for anomalous spikes that could indicate infinite loop conditions in network processing paths
Apply kernel updates from distribution vendors that address net/sched subsystem vulnerabilities
Implement network segmentation to limit exposure of traffic control interfaces to untrusted networks

Evidence notes

CVE published 2025-08-12; modified 2026-02-25 per CISA republication of Siemens SSA-355557. Siemens threat assessment categorizes this CVE as 'Misinformed' for affected products. Source advisory underwent multiple revisions: initial publication (2025-08-12), corrected affected products list (2026-02-12), clarified SCALANCE family configuration and removed rejected CVEs (2026-02-24), and final CISA republication update (2026-02-25).

Sources and references

Verified primary and authoritative sources

CVE-2024-40995 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-40995

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-40995 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-40995

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.