PatchSiren cyber security CVE debrief

CVE-2024-26839 Siemens CVE debrief

A memory leak vulnerability in the Linux kernel's InfiniBand hfi1 driver, specifically in the `init_credit_return` function, has been identified and resolved. The vulnerability was published on August 12, 2025, and last modified on February 25, 2026. Siemens has assessed this CVE as 'Misinformed' for affected industrial control system products including the RUGGEDCOM RST2428P and SCALANCE X family devices running SINEC OS. The source advisory (ICSA-25-226-15) underwent multiple revisions, with the most recent update on February 25, 2026, reflecting republication based on Siemens ProductCERT advisory SSA-613116. No CVSS score or severity rating is available in the source data. This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations running Linux systems with Intel Omni-Path (hfi1) InfiniBand adapters should ensure kernel patches are applied. Industrial operators using Siemens RUGGEDCOM RST2428P or SCALANCE X family devices with SINEC OS should monitor Siemens ProductCERT guidance, though the vendor assessment indicates this CVE is misinformed for these products.

Technical summary

The vulnerability exists in the Linux kernel's InfiniBand hfi1 (Intel Omni-Path) driver within the `init_credit_return` function. The issue involves a memory leak that occurs during initialization of credit return mechanisms. The fix resolves improper memory management in this driver path. While the underlying kernel vulnerability is valid, Siemens has assessed this CVE as 'Misinformed' for their specific product lineup, indicating the vulnerability does not affect their implementations as originally reported or the products are not vulnerable in their deployed configurations.

Defensive priority

low

Recommended defensive actions

Review Siemens ProductCERT advisory SSA-613116 for product-specific guidance
Verify SINEC OS version compliance (note: versions below 3.1 are not supported for SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family)
Apply kernel updates from Linux distribution maintainers if running affected IB/hfi1 driver code
Follow CISA ICS recommended practices for defense-in-depth strategies

Evidence notes

Source advisory ICSA-25-226-15 explicitly categorizes this CVE's impact as 'Misinformed' for all listed product IDs (CSAFPID-0001, CSAFPID-0003, CSAFPID-0004). The vulnerability description indicates a kernel-level memory leak fix in IB/hfi1 driver. Advisory revision history shows four updates, with the final republication on 2026-02-25 based on Siemens SSA-613116.

Sources and references

Verified primary and authoritative sources

CVE-2024-26839 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-26839

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-26839 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-26839

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.