PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-44949 Linux CVE debrief

This CVE addresses a DMA corruption vulnerability in the PA-RISC (parisc) Linux kernel architecture. The root cause is an insufficient ARCH_DMA_MINALIGN value of 16 bytes, which can result in two unrelated 16-byte allocations sharing the same cache line. When one allocation is written via DMA and the other via cached write, DMA-written data may be corrupted. The vulnerability was published on 2025-08-12 and last modified on 2026-02-25. CISA's advisory ICSA-25-226-07, which tracks this issue as part of Siemens Third-Party Components in SINEC OS, underwent multiple revisions—most recently on 2026-02-25 to incorporate updates from Siemens ProductCERT advisory SSA-355557. Notably, the CISA advisory marks the impact as 'Misinformed' for the affected product IDs, and the source data indicates zero actually affected products despite listing product names. The CVSS v3.1 score of 5.5 (MEDIUM) reflects the potential for data integrity issues in affected systems.

Vendor
Linux
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations running Siemens industrial networking equipment with PA-RISC-based components or Linux-based SINEC OS deployments; kernel maintainers for PA-RISC architecture; OT security teams monitoring CISA ICS advisories

Technical summary

The vulnerability stems from ARCH_DMA_MINALIGN being defined as 16 bytes in the PA-RISC architecture code. This alignment value is smaller than typical cache line sizes, allowing two independent 16-byte memory allocations to occupy the same cache line. The coherency problem emerges when one allocation is accessed through DMA (bypassing CPU caches) while the other is accessed through cached CPU writes. Under these conditions, the DMA-written data can be corrupted by subsequent cache writeback operations. This is a classic cache aliasing issue that affects data integrity rather than confidentiality or availability. The fix would involve increasing ARCH_DMA_MINALIGN to match or exceed the cache line size, ensuring DMA buffers are properly isolated from other allocations.

Defensive priority

medium

Recommended defensive actions

  • Review Siemens ProductCERT advisory SSA-355557 for authoritative product impact assessment
  • Verify actual affected product status given CISA's 'Misinformed' impact designation
  • Apply kernel updates from Siemens if product is confirmed affected
  • Monitor CISA ICS advisories for potential updates to affected product list

Evidence notes

The source CISA CSAF advisory explicitly lists the impact category as 'Misinformed' for product IDs CSAFPID-0006, CSAFPID-0002, and CSAFPID-0003. The revision history shows the advisory was republished on 2026-02-25 based on Siemens ProductCERT SSA-355557. Despite product names being listed (RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, SCALANCE XCM-/XRM-/XCH-/XRH-300 family), the affected product count is zero per the source metadata.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-44949 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-44949

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-44949 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-44949

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.