PatchSiren cyber security CVE debrief

CVE-2024-38598 Siemens CVE debrief

A vulnerability in the Linux kernel's md (Multiple Device) driver could cause a softlockup during RAID resync operations when the bitmap size is smaller than the array size. This local denial-of-service condition requires low privileges and no user interaction. Siemens has identified this vulnerability affects certain industrial networking products running SINEC OS, with a vendor fix available in version 3.1 or later. The issue was initially published on August 12, 2025, with subsequent advisory updates through February 2026 to correct affected product listings and remove rejected CVEs.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-04-09
Original CVE updated: 2026-05-14
Advisory published: 2024-04-09
Advisory updated: 2026-05-14

Who should care

Organizations operating Siemens industrial networking equipment with RAID configurations, particularly those in critical infrastructure sectors using SCALANCE and RUGGEDCOM product families. System administrators responsible for Linux-based industrial control systems and RAID array maintenance should prioritize this update to prevent potential denial-of-service during resync operations.

Technical summary

The vulnerability exists in the Linux kernel's md (Multiple Device) driver, specifically during RAID resync operations. When the bitmap size is configured to be smaller than the array size, the resync process can trigger a softlockup condition. This is a local vulnerability requiring low privileges with no user interaction needed. The CVSS 3.1 score of 5.5 (MEDIUM) reflects the local attack vector and high availability impact. Siemens has confirmed this affects SINEC OS running on RUGGEDCOM RST2428P and SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family devices. The fix involves proper handling of bitmap size mismatches during resync operations.

Defensive priority

medium

Recommended defensive actions

Apply vendor fix: Update affected Siemens SINEC OS products to version 3.1 or later
Verify RAID array configurations ensure bitmap sizing aligns with array dimensions
Monitor system logs for softlockup indicators during resync operations on affected systems
Review CISA ICS recommended practices for defense-in-depth strategies for industrial control systems

Evidence notes

CVE published 2025-08-12; modified 2026-02-25. Advisory ICSA-25-226-15 underwent multiple revisions: initial publication (2025-08-12), corrected affected products (2026-02-12), removed rejected CVEs (2026-02-24), and final CISA republication based on Siemens SSA-613116 (2026-02-25). CVSS 3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Official resources

2025-08-12