Siemens RUGGEDCOM RST2428P NULL Pointer Dereference (CVE-2026-22976)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505431);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/17");

  script_cve_id("CVE-2026-22976");
  script_xref(name:"ICSA", value:"26-188-05");

  script_name(english:"Siemens RUGGEDCOM RST2428P NULL Pointer Dereference (CVE-2026-22976)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_qfq: Fix NULL deref when deactivating inactive
aggregate in qfq_reset    `qfq_class->leaf_qdisc->q.qlen > 0` does not
imply that the class  itself is active.    Two qfq_class objects may
point to the same leaf_qdisc. This happens  when:    1. one QFQ qdisc
is attached to the dev as the root qdisc, and    2. another QFQ qdisc
is temporarily referenced (e.g., via qdisc_get()  / qdisc_put()) and
is pending to be destroyed, as in function  tc_new_tfilter.    When
packets are enqueued through the root QFQ qdisc, the shared
leaf_qdisc->q.qlen increases. At the same time, the second QFQ  qdisc
triggers qdisc_put and qdisc_destroy: the qdisc enters  qfq_reset()
with its own q->q.qlen == 0, but its class's leaf  qdisc->q.qlen > 0.
Therefore, the qfq_reset would wrongly deactivate  an inactive
aggregate and trigger a null-deref in qfq_deactivate_agg:    [
0.903172] BUG: kernel NULL pointer dereference, address:
0000000000000000  [    0.903571] #PF: supervisor write access in
kernel mode  [    0.903860] #PF: error_code(0x0002) - not-present page
[    0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0  [
0.904502] Oops: Oops: 0002 [#1] SMP NOPTI  [    0.904737] CPU: 0 UID:
0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE  [
0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014  [
0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992
(discriminator 2) include/linux/list.h:1006 (discriminator 2)
net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393
(discriminator 2))  [    0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18
8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13
48 8b 30 48 d3 ea 8b 4b 18 0    Code starting with the faulting
instruction  ===========================================     0:   0f
84 4d 01 00 00       je     0x153     6:   48 89 70 18             mov
%rsi,0x18(%rax)     a:   8b 4b 10                mov
0x10(%rbx),%ecx     d:   48 c7 c2 ff ff ff ff    mov
$0xffffffffffffffff,%rdx    14:   48 8b 78 08             mov
0x8(%rax),%rdi    18:   48 d3 e2                shl    %cl,%rdx    1b:
48 21 f2                and    %rsi,%rdx    1e:   48 2b 13
sub    (%rbx),%rdx    21:   48 8b 30                mov    (%rax),%rsi
24:   48 d3 ea                shr    %cl,%rdx    27:   8b 4b 18
mov    0x18(%rbx),%ecx          ...  [    0.907095] RSP:
0018:ffffc900004a39a0 EFLAGS: 00010246  [    0.907368] RAX:
ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000  [
0.907723] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
0000000000000000  [    0.908100] RBP: ffff888102952180 R08:
0000000000000000 R09: 0000000000000000  [    0.908451] R10:
ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000  [
0.908804] R13: ffff888102952180 R14: ffff8881043a0ad8 R15:
ffff8881043a0880  [    0.909179] FS:  000000002a1a0380(0000)
GS:ffff888196d8d000(0000) knlGS:0000000000000000  [    0.909572] CS:
0010 DS: 0000 ES: 0000 CR0: 0000000080050033  [    0.909857] CR2:
0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0  [
0.910247] PKRU: 55555554  [    0.910391] Call Trace:  [    0.910527]
<TASK>  [    0.910638]  qfq_reset_qdisc (net/sched/sch_qfq.c:357
net/sched/sch_qfq.c:1485)  [    0.910826]  qdisc_reset
(include/linux/skbuff.h:2195 include/linux/skbuff.h:2501
include/linux/skbuff.h:3424 include/linux/skbuff.h:3430
net/sched/sch_generic.c:1036)  [    0.911040]  __qdisc_destroy
(net/sched/sch_generic.c:1076)  [    0.911236]  tc_new_tfilter
(net/sched/cls_api.c:2447)  [    0.911447]  rtnetlink_rcv_msg
(net/core/rtnetlink.c:6958)  [    0.911663]  ? __pfx_rtnetlink_rcv_msg
(net/core/rtnetlink.c:6861)  [    0.911894]  netlink_rcv_skb
(net/netlink/af_netlink.c:2550)  [    0.912100]  netlink_unicast
(net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)  [
0.912296]  ? __alloc_skb (net/core/skbuff.c:706)  [    0.912484]
netlink_sendmsg (net/netlink/af  ---truncated---

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-253495.html");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/110002573/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/ICSA-26-188-05");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-22976");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(476);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/18");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rst2428p_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:ruggedcom_rst2428p_firmware" :
        {"family" : "RuggedCom", "orderNumbers" : ['6GK6242-6PA00'], "versionEndExcluding" : "4.0"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);