PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-26897 Siemens CVE debrief

A race condition in the Linux kernel's ath9k wireless driver could allow a local attacker to cause a denial of service. The vulnerability exists because ath9k_wmi_event_tasklet() may execute before device initialization is complete, leading to use of uninitialized data structures. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates this requires local access, low privileges, and high attack complexity, with availability impact as the primary concern. Siemens has identified this as affecting the GNU/Linux subsystem of SIMATIC S7-1500 TM MFP industrial control devices. No patch is currently available; mitigations focus on restricting access to the interactive shell and ensuring only trusted applications are executed.

Vendor
Siemens
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS
MEDIUM 4.7
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-09
Original CVE updated
2026-05-14
Advisory published
2024-04-09
Advisory updated
2026-05-14

Who should care

Organizations operating Siemens SIMATIC S7-1500 TM MFP programmable logic controllers with enabled GNU/Linux subsystems and wireless capabilities. Industrial control system operators in manufacturing, process control, and critical infrastructure sectors where these devices are deployed. Security teams responsible for embedded Linux systems using Qualcomm Atheros ath9k wireless chipsets. Asset owners should prioritize this vulnerability if their S7-1500 TM MFP devices expose wireless interfaces or allow user interaction with the GNU/Linux subsystem.

Technical summary

The ath9k wireless driver in the Linux kernel contains a race condition where ath9k_wmi_event_tasklet() may process events before the driver has finished initializing its internal data structures. This timing window can result in dereferencing uninitialized pointers or accessing invalid memory states, causing kernel panics or device crashes. The vulnerability is triggered through local interaction with the wireless subsystem and requires the ability to generate WMI events during the initialization phase. On affected Siemens SIMATIC S7-1500 TM MFP devices, this manifests in the GNU/Linux subsystem where the ath9k driver may be loaded for wireless connectivity. The high attack complexity reflects the narrow timing window and specific conditions required to trigger the race condition.

Defensive priority

medium

Recommended defensive actions

  • Restrict interactive shell access on affected SIMATIC S7-1500 TM MFP GNU/Linux subsystems to trusted personnel only
  • Implement application allowlisting to ensure only trusted applications are built and executed on affected systems
  • Monitor for anomalous wireless driver activity or system crashes that may indicate exploitation attempts
  • Apply vendor patches when Siemens releases updated firmware for the GNU/Linux subsystem
  • Review and implement CISA ICS recommended practices for defense-in-depth strategies

Evidence notes

CVE published 2024-04-09 per official CVE record. CISA advisory ICSA-24-102-01 published same date. Modified 2026-05-14. CVSS 4.7 (MEDIUM) from NVD. CWE-20 (Improper Input Validation) identified. Affects SIMATIC S7-1500 TM MFP GNU/Linux subsystem only.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-26897 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-26897

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-26897 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-26897

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-102-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-265688.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-265688.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-102-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.