CVE-2025-21767 Siemens CVE debrief

Who should care

Siemens SIMATIC S7-1500 operators, OT/ICS security teams, and integrators responsible for the affected CPU models, especially where the additional GNU/Linux subsystem is used or where Linux kernel behavior is relevant.

Technical summary

The root cause is an atomic-context violation in the Linux clocksource watchdog CPU selection path. clocksource_verify_choose_cpus() runs with preemption disabled and invokes get_random_u32() to select CPUs. On PREEMPT_RT kernels, the entropy-related locks involved in that call are sleeping locks, so taking them from atomic context can produce a 'sleeping function called from invalid context' warning and a kernel BUG. The upstream fix described in the source uses migrate_disable() so smp_processor_id() can be used reliably without introducing atomic context, then applies preempt_disable() later to avoid unexpected latency during the measurement path.

Defensive priority

Medium — prioritize affected OT deployments because the issue can destabilize the Linux subsystem and the advisory says no vendor fix is currently available.

Recommended defensive actions

• Inventory the listed Siemens SIMATIC S7-1500 and SIPLUS CPU models and confirm whether the additional GNU/Linux subsystem is enabled in your deployment.
• Restrict access to the interactive shell of the additional GNU/Linux subsystem to trusted personnel only.
• Only build and run applications from trusted sources on affected devices.
• Monitor Siemens ProductCERT and CISA advisory updates for remediation guidance or a vendor fix.
• If you maintain custom Linux builds, verify whether the upstream migrate_disable() fix is present where applicable.
• Follow CISA ICS defense-in-depth and recommended-practices guidance for layered protection while awaiting remediation.

Evidence notes

The supplied advisory describes a PREEMPT_RT kernel bug that can call get_random_u32() in atomic context, causing a sleeping-function warning and kernel BUG. The supplied CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, which supports an availability-focused impact. The source advisory lists five affected Siemens CPU variants and explicitly states 'Currently no fix is available.' Timing context: the CVE/public advisory date is 2025-06-10, and the latest supplied source modification is 2026-05-14; those are publication/update dates, not the issue creation date.

Official resources