PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-26845 Siemens CVE debrief

This CVE addresses a vulnerability in the Linux kernel's SCSI target subsystem. The issue involves improper handling of Task Management Functions (TMF) in the tmr_list, which could lead to race conditions or use-after-free scenarios in SCSI target mode implementations. The vulnerability was resolved by adding proper TMF to tmr_list handling in the SCSI target core code. Siemens has identified this as affecting certain industrial networking products running SINEC OS, including the RUGGEDCOM RST2428P and SCALANCE X-family switches. The CISA advisory ICSA-25-226-15, republished on 2026-02-25, incorporates Siemens' ProductCERT advisory SSA-613116. Notably, the threat assessment in the source material categorizes the impact as 'Misinformed,' suggesting potential confusion or misattribution in initial reporting. Organizations should consult vendor guidance for patch availability and apply kernel updates as they become available for affected SINEC OS versions.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations operating Siemens RUGGEDCOM RST2428P or SCALANCE X-family switches with SINEC OS; industrial control system operators using Linux-based storage target implementations; security teams managing OT/ICS environments with SCSI target functionality.

Technical summary

Vulnerability in Linux kernel SCSI target core subsystem involving improper Task Management Function (TMF) handling in tmr_list. Resolved by adding TMF to tmr_list handling. Affects Siemens industrial networking products (RUGGEDCOM RST2428P, SCALANCE X-family) running SINEC OS. Source threat assessment categorizes impact as 'Misinformed.'

Defensive priority

medium

Recommended defensive actions

  • Review Siemens ProductCERT advisory SSA-613116 for affected product versions and patch status
  • Verify SINEC OS version on RUGGEDCOM RST2428P and SCALANCE X-family deployments
  • Apply kernel updates through Siemens SINEC OS maintenance channels when available
  • Monitor CISA ICS advisories for additional guidance on industrial control system protections
  • Implement network segmentation for critical industrial control systems per CISA recommended practices

Evidence notes

CVE published 2025-08-12 per official record. Modified 2026-02-25. Source CISA CSAF advisory ICSA-25-226-15, republished based on Siemens SSA-613116. Threat category marked 'Misinformed' in source. Affects SINEC OS on RUGGEDCOM RST2428P and SCALANCE X-family devices. Linux kernel SCSI target subsystem fix for TMF/tmr_list handling.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-26845 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-26845

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-26845 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-26845

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.