CVE-2025-38684 Siemens CVE debrief

Who should care

Operators or administrators who deploy the affected Siemens-referenced product in the advisory corpus, and teams responsible for Linux kernel traffic-control/qdisc configurations in environments where sch_ets can be exercised. Because the source material includes a product/advisory mismatch, asset owners should first confirm whether their deployed software is actually in scope.

Technical summary

The advisory text says ets_qdisc_change() was purging unused DWRR queues while q->nbands already held a new value. That made cleanup routines look at an inconsistent ets configuration, which could crash in ets_class_qlen_notify() with a kernel NULL pointer dereference during qdisc modification. The stated remediation is to purge idle DWRR queues before assigning the new q->nbands value, while also using the old q->nstrict during cleanup. The supplied CVSS vector is AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H (5.2, Medium), indicating a local, high-complexity, privilege-dependent issue with availability impact.

Defensive priority

Medium. The advisory describes a crash condition with local, privilege-dependent triggering conditions, and the supplied CVSS rates availability highest. Prioritize verification and patching where the affected software is confirmed present, but treat the source/product scope as needing validation because of the mismatch in the supplied corpus.

Recommended defensive actions

• Verify whether the affected advisory applies to your deployed software and version, since the supplied corpus shows a Linux kernel issue alongside Siemens SIMATIC CN 4100 metadata.
• If applicable, update to V5.0 or later version as stated in the supplied remediation.
• Review any automation or administrative workflows that modify qdisc/ETS settings, since the crash is triggered during traffic-control reconfiguration.
• Limit who can perform privileged network configuration changes on affected systems until remediation is complete.
• Monitor for kernel oops or stability issues during qdisc changes, especially in environments using sch_ets or ETS-based configuration.
• Use vendor and CISA advisories as the primary sources for confirmation and remediation timing.

Evidence notes

The corpus includes CISA CSAF advisory ICSA-26-134-10 (published 2026-05-12, republished 2026-05-14) and a Siemens advisory reference SSA-032379. The embedded vulnerability text explicitly describes a Linux kernel net/sched ets bug, including a kernel NULL pointer dereference and crash stack trace in ets_class_qlen_notify(). The supplied remediation states: update to V5.0 or later version. Because the product metadata names Siemens SIMATIC CN 4100 while the description is kernel-specific, scope should be confirmed against the official advisory links before remediation is generalized.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.