PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-50265 Linux CVE debrief

CVE-2024-50265 is a null-pointer-dereference vulnerability in the OCFS2 (Oracle Cluster File System 2) Linux kernel module, specifically within the ocfs2_xa_remove() function. The issue was discovered via Syzkaller kernel fuzzing. According to the source advisory, this CVE is marked as **Misinformed** for affected Siemens products, indicating the vulnerability does not actually impact the listed product configurations. The CVE was initially published on 2025-08-12 and last modified on 2026-02-25. The advisory underwent multiple revisions, with the most recent update on 2026-02-25 reflecting CISA republication based on Siemens ProductCERT SSA-355557. No CVSS score or severity is available in the source data.

Vendor
Linux
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Linux system administrators managing cluster filesystems; security teams tracking kernel vulnerabilities; industrial control system operators using Siemens SCALANCE and RUGGEDCOM products (noting the misinformed classification)

Technical summary

The vulnerability exists in the ocfs2_xa_remove() function of the OCFS2 (Oracle Cluster File System 2) Linux kernel module. A null-pointer-dereference can be triggered, potentially leading to denial of service through system crash. The issue was identified through automated kernel fuzzing with Syzkaller. However, the authoritative source advisory marks this CVE as 'Misinformed' for the affected Siemens product lines (RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, SCALANCE XCM-/XRM-/XCH-/XRH-300 family), indicating the products are not actually vulnerable to this issue despite initial inclusion in the advisory.

Defensive priority

low

Recommended defensive actions

  • Verify that OCFS2 filesystem support is not enabled or loaded on any Linux-based systems in your environment, particularly those handling cluster storage
  • Review kernel configurations to ensure OCFS2 modules are disabled if not required for operational purposes
  • Apply standard kernel security updates through your distribution's normal patching cycle
  • Monitor for any future reclassification of this CVE's impact on industrial control system products

Evidence notes

The source advisory (ICSA-25-226-07) explicitly categorizes this CVE's impact as 'Misinformed' for the affected product IDs (CSAFPID-0006, CSAFPID-0002, CSAFPID-0003). The vulnerability description references Syzkaller fuzzing of the Linux kernel OCFS2 filesystem, which is not typically deployed on Siemens industrial network devices. The advisory revision history shows this CVE was retained while other rejected CVEs were removed in the 2026-02-24 update.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-50265 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-50265

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-50265 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-50265

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-355557.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-355557.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.