CVE-2025-38471 Siemens CVE debrief

Who should care

OT/ICS teams operating the Siemens SIMATIC S7-1500 CPU family products named in the advisory, especially environments using the embedded GNU/Linux subsystem or any local shell/application workflows on those devices. Linux kernel and TLS stack maintainers should also track the upstream bug context and advisory updates.

Technical summary

The CVE description says TLS may operate on a stale skb while determining whether all queued skbs match decrypt state and geometry. Recent TCP skb compaction changes exposed the flaw, and the provided trace shows a KASAN slab-use-after-free in tls_strp_check_rcv() during tls_rx_rec_wait() / tls_sw_recvmsg() / inet_recvmsg() handling. The published vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access is required and impact can be severe once triggered.

Defensive priority

High. The attack surface is local rather than remote, but the source severity is still 7.8 and the advisory notes no current fix. Prioritize asset identification, access restriction, and advisory monitoring for the affected Siemens product set.

Recommended defensive actions

• Confirm whether any of the five Siemens SIMATIC S7-1500 CPU family products listed in the advisory are deployed in your environment.
• Apply the source-listed mitigations: limit access to the interactive shell to trusted personnel only, and only build or run applications from trusted sources.
• Monitor the Siemens ProductCERT and CISA advisory pages for updates, because the source currently states that no fix is available.
• Restrict local access to affected systems and apply least-privilege controls where these devices expose Linux/TLS functionality.
• Use CISA ICS defense-in-depth and recommended practices for additional hardening around affected OT assets.

Evidence notes

The supplied CVE description attributes the bug to Linux kernel TLS receive-path handling and includes a KASAN slab-use-after-free trace. The CISA CSAF source (ICSA-25-162-05 / Siemens SSA-082556) maps CVE-2025-38471 to five Siemens SIMATIC S7-1500 CPU family products and includes the remediation note 'Currently no fix is available.' Timing in this debrief follows the supplied CVE publishedAt date of 2025-06-10 and the source/advisory modifiedAt date of 2026-05-14; generation time is not treated as the issue date.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.