PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-26688 Siemens CVE debrief

CVE-2024-26688 is a NULL pointer dereference vulnerability in the Linux kernel's hugetlb filesystem (hugetlbs_fill_super). The vulnerability was resolved in the upstream Linux kernel. Siemens has assessed this CVE as 'Misinformed' for affected industrial networking products including the RUGGEDCOM RST2428P and SCALANCE X-family devices, indicating the vulnerability does not affect these products as initially reported. The CISA advisory ICSA-25-226-15, republished on 2026-02-25, reflects this updated assessment based on Siemens ProductCERT advisory SSA-613116. No CVSS score or severity is available in the source corpus. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, or SCALANCE XCM-/XRM-/XCH-/XRH-300 family industrial networking equipment should verify their exposure based on Siemens ProductCERT guidance rather than the raw CVE description.

Technical summary

The vulnerability exists in hugetlbs_fill_super() in the Linux kernel's hugetlb filesystem implementation. A NULL pointer dereference could occur during superblock initialization. The issue was resolved upstream. Siemens products running SINEC OS were initially flagged but subsequently assessed as not affected ('Misinformed' impact rating per CISA CSAF threat data).

Defensive priority

low

Recommended defensive actions

  • Verify current SINEC OS and firmware versions on affected Siemens industrial networking equipment per vendor guidance
  • Review Siemens ProductCERT advisory SSA-613116 for definitive product impact assessment
  • Apply vendor-recommended updates for SINEC OS and SCALANCE/RUGGEDCOM firmware as applicable
  • Monitor CISA ICS advisories for updates to ICSA-25-226-15

Evidence notes

Source CISA CSAF advisory ICSA-25-226-15 (republished 2026-02-25) indicates Siemens assessed this CVE as 'Misinformed' for affected products. The advisory revision history shows corrections to affected products list and removal of rejected CVEs in subsequent updates.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-26688 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-26688

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-26688 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-26688

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.