PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-21638 Siemens CVE debrief

A null-pointer dereference vulnerability exists in the Linux kernel's SCTP (Stream Control Transmission Protocol) sysctl implementation for the `auth_enable` parameter. The flaw occurs when the kernel accesses `current->nsproxy` to obtain network namespace information during sysctl read/write operations. In specific scenarios—such as when a task is exiting—`current->nsproxy` can be NULL, causing an Oops (kernel crash). This was identified by syzbot using the `acct(2)` system call. The vulnerability stems from inconsistent namespace handling: using the reader's/writer's network namespace versus only the opener's namespace. The fix retrieves the `net` structure from `table->data` using `container_of()` rather than through the current task's namespace proxy. Siemens has confirmed this vulnerability affects the GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP industrial control system.

Vendor
Siemens
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-09
Original CVE updated
2026-05-14
Advisory published
2024-04-09
Advisory updated
2026-05-14

Who should care

Organizations running Siemens SIMATIC S7-1500 TM MFP systems with the GNU/Linux subsystem enabled, industrial control system operators, Linux kernel maintainers for embedded/ICS environments, and security teams responsible for OT/ICS infrastructure.

Technical summary

The vulnerability exists in the Linux kernel's SCTP protocol implementation, specifically in the sysctl handler for `auth_enable`. The code incorrectly uses `current->nsproxy` to access network namespace information, which can be NULL when the current task is exiting. This results in a null-pointer dereference (Oops). The proper fix uses `container_of()` on `table->data` to obtain the `net` structure directly. The vulnerability is local (AV:L), requires low privileges (PR:L), and can cause high availability impact (A:H) through denial of service (kernel crash).

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from Siemens when available for the SIMATIC S7-1500 TM MFP GNU/Linux subsystem
  • Restrict interactive shell access to the GNU/Linux subsystem to trusted personnel only
  • Only build and run applications from trusted sources on affected systems
  • Monitor for kernel Oops messages in system logs that may indicate exploitation attempts
  • Review network namespace isolation configurations to minimize attack surface

Evidence notes

The vulnerability description indicates this was resolved in the Linux kernel with a commit that avoids using `current->nsproxy` in the SCTP sysctl `auth_enable` handler. The issue was detected by syzbot using `acct(2)`. Siemens has included this CVE in their security advisory SSA-265688 for the SIMATIC S7-1500 TM MFP product, with the CISA ICS advisory ICSA-24-102-01 tracking this and related vulnerabilities. The advisory was initially published on 2024-04-09 and has been updated multiple times through September 2025 to include additional CVEs.

Official resources

2024-04-09