PatchSiren cyber security CVE debrief

CVE-2024-26688 Siemens CVE debrief

CVE-2024-26688 is a NULL pointer dereference vulnerability in the Linux kernel's hugetlb filesystem (hugetlbs_fill_super). The vulnerability was resolved in the upstream Linux kernel. Siemens has assessed this CVE as 'Misinformed' for affected industrial networking products including the RUGGEDCOM RST2428P and SCALANCE X-family devices, indicating the vulnerability does not affect these products as initially reported. The CISA advisory ICSA-25-226-15, republished on 2026-02-25, reflects this updated assessment based on Siemens ProductCERT advisory SSA-613116. No CVSS score or severity is available in the source corpus. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, or SCALANCE XCM-/XRM-/XCH-/XRH-300 family industrial networking equipment should verify their exposure based on Siemens ProductCERT guidance rather than the raw CVE description.

Technical summary

The vulnerability exists in hugetlbs_fill_super() in the Linux kernel's hugetlb filesystem implementation. A NULL pointer dereference could occur during superblock initialization. The issue was resolved upstream. Siemens products running SINEC OS were initially flagged but subsequently assessed as not affected ('Misinformed' impact rating per CISA CSAF threat data).

Defensive priority

low

Recommended defensive actions

Verify current SINEC OS and firmware versions on affected Siemens industrial networking equipment per vendor guidance
Review Siemens ProductCERT advisory SSA-613116 for definitive product impact assessment
Apply vendor-recommended updates for SINEC OS and SCALANCE/RUGGEDCOM firmware as applicable
Monitor CISA ICS advisories for updates to ICSA-25-226-15

Evidence notes

Source CISA CSAF advisory ICSA-25-226-15 (republished 2026-02-25) indicates Siemens assessed this CVE as 'Misinformed' for affected products. The advisory revision history shows corrections to affected products list and removal of rejected CVEs in subsequent updates.

Official resources

2025-08-12