PatchSiren cyber security CVE debrief

CVE-2024-56532 Siemens CVE debrief

CVE-2024-56532 describes a vulnerability in the ALSA us122l driver where snd_card_free() is used at disconnection, which waits for all used file descriptors to close. This can cause extended delays that block upper-layer USB ioctls and potentially trigger a soft lockup. The vulnerability was published on 2025-08-12 and last modified on 2026-02-25. Siemens has identified this CVE as affecting their RUGGEDCOM RST2428P (6GK6242-6PA00) product, though the CISA advisory marks the impact assessment as 'Misinformed' for the affected product IDs. The vulnerability originates in the Linux kernel's ALSA subsystem and represents a denial-of-service condition through resource exhaustion during USB audio device disconnection.

Vendor: Siemens
Product: RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-08-12
Original CVE updated: 2026-02-25
Advisory published: 2025-08-12
Advisory updated: 2026-02-25

Who should care

Organizations running Linux-based industrial control systems, particularly those using Siemens RUGGEDCOM RST2428P devices or other systems with USB audio connectivity. System administrators maintaining embedded Linux deployments with ALSA sound support should monitor for kernel updates addressing this driver issue.

Technical summary

The ALSA us122l driver in the Linux kernel uses snd_card_free() during USB device disconnection. This function waits for all open file descriptors to close before completing, which can cause significant delays. When these delays occur, they block upper-layer USB ioctl operations, potentially triggering a kernel soft lockup. This represents a local denial-of-service condition that could affect system availability. The vulnerability is particularly relevant for embedded and industrial systems using USB audio interfaces based on the Tascam US-122L hardware.

Defensive priority

medium

Recommended defensive actions

Review Siemens ProductCERT SSA-355557 advisory for current product impact assessment
Monitor CISA ICS advisory ICSA-25-226-07 for updates on affected product configurations
Apply kernel updates from Linux distribution vendors that address ALSA us122l driver timing issues
For affected Siemens RUGGEDCOM RST2428P deployments, follow vendor guidance for patch management
Implement defense-in-depth strategies per CISA ICS recommended practices for industrial control systems

Evidence notes

The vulnerability description indicates a soft lockup condition in the ALSA us122l driver during USB disconnection. Siemens ProductCERT SSA-355557 advisory and CISA ICSA-25-226-07 provide the authoritative product impact assessment. The CISA advisory revision history shows multiple updates through 2026-02-25, with the latest republication based on the Siemens advisory. The threat category is marked as 'Misinformed' for affected products CSAFPID-0006, CSAFPID-0002, and CSAFPID-0003 in the source data.

Official resources

2025-08-12