PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-38676 Siemens CVE debrief

CVE-2025-38676 is a Linux kernel memory-safety issue in the amd IOMMU path that can write one byte past the end of the acpiid buffer when processing a maximum-length command-line string. The advisory maps the issue to Siemens SIMATIC CN 4100 systems earlier than V5.0 and recommends upgrading to V5.0 or later.

Vendor
Siemens
Product
SIMATIC CN 4100
CVSS
MEDIUM 6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-14
Advisory published
2026-05-12
Advisory updated
2026-05-14

Who should care

Siemens SIMATIC CN 4100 owners and maintainers, OT security teams, Linux kernel integrators, and defenders responsible for embedded or appliance images that inherit the affected kernel code path.

Technical summary

According to the advisory text, the kernel command line is usually trusted, but the amd iommu code could overflow a stack buffer by one byte if the str argument reached maximum length. The issue is described as a stack buffer overflow in kernel code, with CVSS 3.1 vector AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H. CISA’s republished advisory ties the issue to Siemens SIMATIC CN 4100 versions before 5.0 and points to Siemens ProductCERT SSA-032379 for remediation.

Defensive priority

Medium. The flaw is locally reachable and requires high privileges, but it affects kernel code and carries high integrity/availability impact in the published CVSS vector.

Recommended defensive actions

  • Update Siemens SIMATIC CN 4100 to V5.0 or later, per Siemens guidance.
  • Confirm whether your deployed images include the affected Linux kernel code path and whether the Siemens advisory applies to your environment.
  • Track CISA advisory ICSA-26-134-10 and Siemens ProductCERT SSA-032379 for any product-specific remediation details.
  • If you maintain customized builds, verify that the kernel fix for the iommu/amd acpiid handling is present in your software baseline.
  • Use standard ICS defense-in-depth practices such as segmentation, least privilege, and controlled administrative access around affected assets.

Evidence notes

The source corpus shows CISA publication on 2026-05-12 and republication on 2026-05-14 from Siemens ProductCERT SSA-032379. The vulnerability description is limited to a one-byte stack overflow risk in iommu/amd when the command-line string is at maximum length. The product mapping in the advisory is marked low confidence and needs review.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-38676 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-38676

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-38676 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-38676

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-134-10.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-032379.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-032379.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-10

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.