PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-39188 Siemens CVE debrief

CVE-2022-39188 describes a Linux kernel race condition that can let a device driver free a page while stale TLB entries still exist. In the Siemens advisory published by CISA on 2025-02-11, the issue is tied to multiple SCALANCE W700 product variants and the recommended remediation is to update to V3.0.0 or later. The published CVSS score is 4.7 (MEDIUM), with impact concentrated on availability.

Vendor
Siemens
Product
SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0)
CVSS
MEDIUM 4.7
CISA KEV
Not listed in stored evidence
Original CVE published
2023-06-13
Original CVE updated
2024-04-09
Advisory published
2023-06-13
Advisory updated
2024-04-09

Who should care

Operators and maintainers of the listed Siemens SCALANCE WAB/WAM/WUB/WUM devices, OT/ICS administrators responsible for patch planning, and security teams that track Linux-kernel-derived issues in embedded networking equipment.

Technical summary

The vulnerability is described as a race between unmap_mapping_range and munmap in include/asm-generic/tlb.h in Linux kernels before 5.19. Under the specific condition of VM_PFNMAP VMAs, a device driver can free a page while stale TLB entries remain, creating an availability-impacting memory-management flaw. The Siemens advisory maps this upstream Linux issue to 19 affected SCALANCE product identifiers and provides a vendor remediation path to V3.0.0 or later.

Defensive priority

Medium — plan a timely maintenance update to the vendor-fixed version, verify affected product coverage, and validate service behavior after patching.

Recommended defensive actions

  • Identify whether any of the 19 Siemens SCALANCE product variants listed in the advisory are in your environment.
  • Check the installed vendor/software version against Siemens remediation guidance and plan an upgrade to V3.0.0 or later.
  • Schedule the update through normal OT maintenance/change-control processes and confirm operational compatibility after installation.
  • Use CISA and Siemens advisory references to confirm the exact affected product IDs before deploying the fix.
  • Apply ICS defense-in-depth practices around segmentation, access control, and monitoring as part of the update plan.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-25-044-09, the Siemens advisory references, and the CVE/NVD record links supplied in the source corpus. The CVE description and CVSS vector indicate a local, low-privilege, no-user-interaction issue with high availability impact and no stated confidentiality or integrity impact. The source corpus also provides a vendor fix statement: update to V3.0.0 or later. No KEV entry was supplied.

Sources and references

Verified primary and authoritative sources

  • CVE-2022-39188 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2022-39188

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2022-39188 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2022-39188

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-044-09.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-769027.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-769027.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-09

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.