PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-37972 Linux CVE debrief

A null pointer dereference vulnerability exists in the Linux kernel's mtk-pmic-keys driver. The vulnerability occurs when the button node is not parsed in the device tree, causing the regs parameter to be null. This can happen on hardware where the button is left floating and the node is removed to prevent enabling the input. To address this, the code can use the regs struct instead, which is defined for all supported platforms.

Vendor
Linux
Product
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-14
Original CVE updated
2026-07-28
Advisory published
2026-07-14
Advisory updated
2026-07-28

Who should care

Defenders of Linux-based systems, particularly those using Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP and SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, should assess exposure and prioritize remediation.

Why it matters

CVE-2025-37972 is a medium-severity vulnerability in the Linux kernel's mtk-pmic-keys driver that can lead to denial of service. Defenders of affected Linux-based systems should assess exposure and prioritize remediation.

  • Denial of service due to null pointer dereference
  • Potential system crashes or instability
  • Need for verification of affected versions and remediation status

Technical summary

The vulnerability exists in the mtk-pmic-keys driver of the Linux kernel. It occurs when the button node is not parsed in the device tree, leading to a null pointer dereference. The fix involves using the regs struct instead of the potentially null regs parameter. This change ensures that the code can handle cases where the button node is not present in the device tree, preventing a null pointer dereference. Affected Linux-based systems, particularly those using specific Siemens products like SIMATIC S7-1500 CPU 1518-4 PN/DP MFP and SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, should assess exposure and prioritize remediation to prevent potential denial-of-service attacks.

Defensive priority

Medium priority remediation is recommended as the vulnerability has a CVSS score of 5.5 and can potentially lead to a denial of service.

Recommended defensive actions

  • Review and apply the fix to use the regs struct instead of the potentially null regs parameter.
  • Limit access to the interactive shell of the additional GNU/Linux subsystem to trusted personnel only.
  • Only build and run applications from trusted sources.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was resolved in the Linux kernel and affects several Siemens products, including SIMATIC S7-1500 CPU 1518-4 PN/DP MFP and SIPLUS S7-1500 CPU 1518-4 PN/DP MFP. The fix involves using the regs struct instead of the potentially null regs parameter.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-37972 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-37972

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-37972 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-37972

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • CVE-2025-37972

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-209-04.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-019113.json

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-019113.html

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.