PatchSiren cyber security CVE debrief

CVE-2024-50265 Linux CVE debrief

CVE-2024-50265 is a null-pointer-dereference vulnerability in the OCFS2 (Oracle Cluster File System 2) Linux kernel module, specifically within the ocfs2_xa_remove() function. The issue was discovered via Syzkaller kernel fuzzing. According to the source advisory, this CVE is marked as **Misinformed** for affected Siemens products, indicating the vulnerability does not actually impact the listed product configurations. The CVE was initially published on 2025-08-12 and last modified on 2026-02-25. The advisory underwent multiple revisions, with the most recent update on 2026-02-25 reflecting CISA republication based on Siemens ProductCERT SSA-355557. No CVSS score or severity is available in the source data.

Vendor: Linux
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Linux system administrators managing cluster filesystems; security teams tracking kernel vulnerabilities; industrial control system operators using Siemens SCALANCE and RUGGEDCOM products (noting the misinformed classification)

Technical summary

The vulnerability exists in the ocfs2_xa_remove() function of the OCFS2 (Oracle Cluster File System 2) Linux kernel module. A null-pointer-dereference can be triggered, potentially leading to denial of service through system crash. The issue was identified through automated kernel fuzzing with Syzkaller. However, the authoritative source advisory marks this CVE as 'Misinformed' for the affected Siemens product lines (RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, SCALANCE XCM-/XRM-/XCH-/XRH-300 family), indicating the products are not actually vulnerable to this issue despite initial inclusion in the advisory.

Defensive priority

low

Recommended defensive actions

Verify that OCFS2 filesystem support is not enabled or loaded on any Linux-based systems in your environment, particularly those handling cluster storage
Review kernel configurations to ensure OCFS2 modules are disabled if not required for operational purposes
Apply standard kernel security updates through your distribution's normal patching cycle
Monitor for any future reclassification of this CVE's impact on industrial control system products

Evidence notes

The source advisory (ICSA-25-226-07) explicitly categorizes this CVE's impact as 'Misinformed' for the affected product IDs (CSAFPID-0006, CSAFPID-0002, CSAFPID-0003). The vulnerability description references Syzkaller fuzzing of the Linux kernel OCFS2 filesystem, which is not typically deployed on Siemens industrial network devices. The advisory revision history shows this CVE was retained while other rejected CVEs were removed in the 2026-02-24 update.

Official resources

2025-08-12