PatchSiren cyber security CVE debrief

CVE-2024-26935 Siemens CVE debrief

A vulnerability in the Linux kernel's SCSI core subsystem could allow a local attacker to cause a denial of service condition. The issue stems from a regression where procfs host directories are not properly removed, leading to resource exhaustion over time. This affects Siemens SIMATIC S7-1500 TM MFP devices that utilize the GNU/Linux subsystem. The vulnerability requires local access with low privileges and no user interaction, making it exploitable by authenticated users with shell access to the affected subsystem.

Vendor: Siemens
Product: SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-04-09
Original CVE updated: 2026-05-14
Advisory published: 2024-04-09
Advisory updated: 2026-05-14

Who should care

Organizations operating Siemens SIMATIC S7-1500 TM MFP devices with the GNU/Linux subsystem enabled, particularly in industrial automation and control system environments where high availability is critical.

Technical summary

The vulnerability exists in the SCSI core subsystem of the Linux kernel where procfs host directories are not properly removed, causing a regression that can lead to resource exhaustion. This is classified under CWE-770: Allocation of Resources Without Limits or Throttling. The affected product is the GNU/Linux subsystem within Siemens SIMATIC S7-1500 TM MFP industrial control devices. No fix is currently available from the vendor.

Defensive priority

medium

Recommended defensive actions

Limit access to the interactive shell of the additional GNU/Linux subsystem to trusted personnel only
Only build and run applications from trusted sources
Monitor for patch availability from Siemens for the SIMATIC S7-1500 TM MFP GNU/Linux subsystem
Apply defense-in-depth strategies for industrial control systems per CISA guidance

Evidence notes

The vulnerability was resolved in the Linux kernel with a fix for unremoved procfs host directory regression. Siemens has confirmed this affects the GNU/Linux subsystem of SIMATIC S7-1500 TM MFP devices. The CVSS 3.1 vector indicates local attack vector with low attack complexity, low privileges required, no user interaction, and high availability impact.

Official resources

2024-04-09