CVE-2025-38687 Siemens CVE debrief

Who should care

Linux and embedded/ICS defenders who manage systems using the comedi driver, plus operators following the Siemens advisory guidance for SIMATIC CN 4100.

Technical summary

The source description says comedi could remove an allocated async area even though poll requests were still active on a wait_queue_head inside that memory. If poll entries were later triggered or removed, the freed memory could be touched again, causing a use-after-free. The fix write-locks dev->attach_lock in the COMEDI_DEVCONFIG path before checking whether subdevice wait queues still have sleepers, and it keeps the lock held through detach after refactoring comedi_device_detach() into comedi_device_detach_locked().

Defensive priority

Medium

Recommended defensive actions

• Identify whether affected kernels or comedi-enabled systems are in use in your environment.
• Apply the vendor or kernel fix; for Siemens-mapped systems, follow the advisory remediation to update to V5.0 or later.
• Restrict access to local device configuration and other privileged paths to trusted administrators only.
• Watch for crashes, hangs, or abnormal behavior around polling and device detachment.
• Track the CISA and Siemens advisory pages for any follow-up updates or clarifications.

Evidence notes

The supplied CVE timeline lists publication on 2026-05-12 and modification on 2026-05-14; the CISA CSAF source item shows the same dates, with a republication note on 2026-05-14. The source text describes a syzbot-reported use-after-free in comedi caused by detaching the device while poll waiters remained active on a wait_queue_head. The CVSS vector provided is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, which aligns with a local, low-privilege availability-impact issue. The source metadata also maps the advisory to Siemens SIMATIC CN 4100 vers:intdot/<5.0, but the vulnerability description itself is explicitly about the Linux kernel comedi driver, so that product mapping should be treated cautiously.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.