CVE-2025-38706 Cert Portal CVE debrief

Who should care

Administrators and operators of Siemens SIMATIC CN 4100 systems, especially environments using audio topology loading or module removal workflows, should care. Linux kernel maintainers and OT defenders who manage appliance software updates should also treat this as an availability risk.

Technical summary

The flaw is described in snd_soc_remove_pcm_runtime(): the function may be called with rtd == NULL, which can lead to a null pointer dereference. The advisory says this was reproduced when a topology link was marked ignore because a hardware component was missing; on module removal, soc_tplg_remove_link() could then call snd_soc_remove_pcm_runtime() even though no runtime had been created. The result is a local availability issue rather than a confidentiality or integrity issue.

Defensive priority

Medium. The CVSS vector supplied with the advisory is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, which indicates a locally reachable crash with high availability impact. In OT or appliance contexts, even local crashes can be operationally significant, so update planning should be prompt.

Recommended defensive actions

• Update affected Siemens SIMATIC CN 4100 systems to V5.0 or later, per the vendor remediation guidance.
• Review any deployments that use topology loading or link-ignore behavior tied to missing hardware components, as these conditions were part of the reproduced scenario.
• Restrict local administrative access to affected systems until remediation is complete, since the attack vector is local.
• Monitor for unexpected kernel crashes or service interruptions during module removal or topology changes.
• Validate vendor maintenance procedures before applying updates in production OT environments.

Evidence notes

The supplied CISA CSAF advisory states that snd_soc_remove_pcm_runtime() might be called with rtd == NULL, leading to a null pointer dereference. It further notes the issue was reproduced with topology loading and a link marked ignore due to a missing hardware component, and that soc_tplg_remove_link() could invoke the function during module removal when no runtime existed. The advisory publication date is 2026-05-12 and it was republished/modified on 2026-05-14.

Official resources