PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-38684 Cert Portal CVE debrief

CVE-2025-38684 is described in the supplied advisory material as a Linux kernel net/sched ets issue that can trigger a NULL pointer dereference during qdisc changes and class cleanup. The fix is to purge idle DWRR queues before updating q->nbands, so ets_class_find() and ets_class_is_strict() operate on a consistent configuration. The source package republished by CISA on 2026-05-14 points to Siemens advisory SSA-032379, but the vendor/product metadata in the corpus does not cleanly match the kernel-focused vulnerability text, so applicability should be verified before taking action.

Vendor
Cert Portal
Product
Siemens SIMATIC CN 4100 vers:intdot/<5.0
CVSS
MEDIUM 5.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-14
Advisory published
2026-05-12
Advisory updated
2026-05-14

Who should care

Operators or administrators who deploy the affected Siemens-referenced product in the advisory corpus, and teams responsible for Linux kernel traffic-control/qdisc configurations in environments where sch_ets can be exercised. Because the source material includes a product/advisory mismatch, asset owners should first confirm whether their deployed software is actually in scope.

Technical summary

The advisory text says ets_qdisc_change() was purging unused DWRR queues while q->nbands already held a new value. That made cleanup routines look at an inconsistent ets configuration, which could crash in ets_class_qlen_notify() with a kernel NULL pointer dereference during qdisc modification. The stated remediation is to purge idle DWRR queues before assigning the new q->nbands value, while also using the old q->nstrict during cleanup. The supplied CVSS vector is AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H (5.2, Medium), indicating a local, high-complexity, privilege-dependent issue with availability impact.

Defensive priority

Medium. The advisory describes a crash condition with local, privilege-dependent triggering conditions, and the supplied CVSS rates availability highest. Prioritize verification and patching where the affected software is confirmed present, but treat the source/product scope as needing validation because of the mismatch in the supplied corpus.

Recommended defensive actions

  • Verify whether the affected advisory applies to your deployed software and version, since the supplied corpus shows a Linux kernel issue alongside Siemens SIMATIC CN 4100 metadata.
  • If applicable, update to V5.0 or later version as stated in the supplied remediation.
  • Review any automation or administrative workflows that modify qdisc/ETS settings, since the crash is triggered during traffic-control reconfiguration.
  • Limit who can perform privileged network configuration changes on affected systems until remediation is complete.
  • Monitor for kernel oops or stability issues during qdisc changes, especially in environments using sch_ets or ETS-based configuration.
  • Use vendor and CISA advisories as the primary sources for confirmation and remediation timing.

Evidence notes

The corpus includes CISA CSAF advisory ICSA-26-134-10 (published 2026-05-12, republished 2026-05-14) and a Siemens advisory reference SSA-032379. The embedded vulnerability text explicitly describes a Linux kernel net/sched ets bug, including a kernel NULL pointer dereference and crash stack trace in ets_class_qlen_notify(). The supplied remediation states: update to V5.0 or later version. Because the product metadata names Siemens SIMATIC CN 4100 while the description is kernel-specific, scope should be confirmed against the official advisory links before remediation is generalized.

Official resources

Public advisory material was published on 2026-05-12 and republished on 2026-05-14 in the supplied corpus. The issue is presented as a defensive, vendor-advisory context item; no exploit instructions are included here.