PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-38499 Siemens CVE debrief

CVE-2025-38499 is a Linux kernel mount-handling vulnerability tracked in Siemens advisory ICSA-25-162-05 / SSA-082556 for SIMATIC S7-1500 CPU family products. The kernel fix description says clone_private_mnt() did not verify CAP_SYS_ADMIN in the correct user namespace, which could allow a clone to expose content hidden by a mount that should not be undoable. CISA’s CSAF record assigns a Medium CVSS 5.5 score with local, low-privilege, availability-only impact, and the advisory states that no fix is currently available.

Vendor
Siemens
Product
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-06-10
Original CVE updated
2026-05-14
Advisory published
2025-06-10
Advisory updated
2026-05-14

Who should care

Operators and maintainers of the affected Siemens SIMATIC S7-1500 CPU family, OT/ICS security teams, and Linux administrators responsible for local access, shell access, and mount-namespace behavior on these devices.

Technical summary

The issue is a missing privilege check in Linux kernel clone_private_mnt(): it checked for MNT_LOCKED-related conditions but did not always verify that the caller had CAP_SYS_ADMIN in the user namespace associated with the namespace mount. The supplied advisory text says the missing check matters because cloning should not expose something hidden by a mount that the caller would not be able to undo. The supplied CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access, low privileges, and high availability impact only.

Defensive priority

Medium, with elevated operational attention in OT environments because the affected Siemens advisory currently lists no fix and the issue can affect availability.

Recommended defensive actions

  • Restrict access to the interactive shell of the additional GNU/Linux subsystem to trusted personnel only.
  • Only build and run applications from trusted sources.
  • Review local privilege boundaries and minimize who can perform mount-related actions on affected devices.
  • Monitor Siemens and CISA advisory updates for SSA-082556 / ICSA-25-162-05, since the supplied advisory says no fix is currently available.

Evidence notes

Evidence comes from the supplied CISA CSAF advisory for ICSA-25-162-05 and its Siemens references. The record lists five affected Siemens SIMATIC S7-1500 CPU family product variants and states that no fix is available. The CVE description specifically identifies the Linux kernel clone_private_mnt() CAP_SYS_ADMIN-in-the-right-userns gap, and the supplied CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-38499 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-38499

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-38499 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-38499

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-162-05.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-082556.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-082556.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-05

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.