CVE-2025-38079 Siemens CVE debrief

Who should care

Operators, engineers, and security teams responsible for the listed Siemens SIMATIC S7-1500 CPU variants, especially where the additional GNU/Linux subsystem is enabled or locally accessible. Also relevant to anyone managing local-user access on affected industrial systems.

Technical summary

The underlying issue is a double free in the Linux kernel’s algif_hash accept path. If accept(2) is invoked on an algif_hash socket with MSG_MORE set and crypto_ahash_import fails, sk2 is freed in that error path and then freed again later by af_alg_release. That creates a slab-use-after-free condition. The advisory data and CVSS vector indicate a local attack scenario with low privileges and no user interaction, with high impacts to confidentiality, integrity, and availability. Siemens ties the issue to affected SIMATIC S7-1500 CPU products that include an additional GNU/Linux subsystem.

Defensive priority

High. The issue is severe, locally reachable under the described conditions, and Siemens reports no fix is currently available. Priority should be highest where local shell or subsystem access cannot be tightly controlled.

Recommended defensive actions

• Restrict access to the additional GNU/Linux subsystem shell to trusted personnel only.
• Only build and run applications from trusted sources.
• Inventory the listed affected SIMATIC S7-1500 CPU variants and confirm whether the GNU/Linux subsystem is enabled or reachable.
• Reduce local access pathways and remove unnecessary users or services on affected devices.
• Monitor Siemens ProductCERT and CISA updates for a future remediation or revision to the advisory.
• Apply layered industrial-control-system defense-in-depth guidance while awaiting a vendor fix.

Evidence notes

The source advisory text states that a failed crypto_ahash_import during accept(2) can free sk2 twice and cause a slab-use-after-free error. The CSAF record lists the affected Siemens SIMATIC S7-1500 CPU variants, marks no current fix as available, and provides mitigations focused on restricting shell access and using trusted software sources. Timing context comes from the supplied CVE published date of 2025-06-10 and latest modified date of 2026-05-14; those are used as the disclosure timeline anchors.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.