PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-38724 Siemens CVE debrief

CVE-2025-38724 describes a Linux kernel nfsd bug in nfsd4_setclientid_confirm() where get_client_locked() failure was not handled correctly. According to the advisory text, a SETCLIENTID_CONFIRM race with a confirmed client expiring could fail to obtain a reference and later lead to a use-after-free. The documented fix is to take a reference earlier when a confirmed client exists and to treat reference acquisition failure as if no confirmed client were found; if the unconfirmed client is expiring, the call should fail and return the get_client_locked() result. CISA published the advisory on 2026-05-12 and republished it on 2026-05-14 with Siemens ProductCERT material.

Vendor
Siemens
Product
SIMATIC CN 4100
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-06-10
Original CVE updated
2026-05-14
Advisory published
2025-06-10
Advisory updated
2026-05-14

Who should care

Operators and maintainers of systems that include the affected Linux kernel NFS server path, especially organizations relying on Siemens SIMATIC CN 4100 per the advisory. ICS defenders, embedded Linux teams, and administrators who expose NFS services should confirm whether their builds include the vulnerable code path and whether vendor guidance applies.

Technical summary

The issue is a missing return-value check in nfsd4_setclientid_confirm(). A race condition can occur when a confirmed NFS client is expiring while SETCLIENTID_CONFIRM runs. If get_client_locked() does not return a valid reference and that failure is ignored, later use of the client object can become a use-after-free. The remediation described in the source is to acquire a reference early for an extant confirmed client and to handle failure paths explicitly so the code does not proceed with an invalid object.

Defensive priority

High for confirmed or suspected affected deployments; otherwise medium until applicability is verified. The advisory’s CVSS 3.1 vector is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Recommended defensive actions

  • Update to V5.0 or later as directed by the Siemens advisory.
  • Verify whether the affected device or image actually contains the vulnerable Linux kernel NFS server code path.
  • If immediate patching is not possible, reduce exposure of NFS services to trusted management networks only.
  • Monitor vendor and CISA guidance for any additional mitigations or scope clarifications.
  • Document affected assets and prioritize them for maintenance windows because the issue can lead to a kernel use-after-free.

Evidence notes

Source corpus ties this CVE to a Linux kernel nfsd use-after-free scenario and also includes Siemens/CISA ICS advisory metadata for Siemens SIMATIC CN 4100 vers:intdot/<5.0. That product mapping is marked low-confidence in the supplied data, so applicability should be validated against the vendor advisory and the actual firmware/software build. The CVSS vector in the source is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and the supplied advisory timestamps are 2026-05-12 (publication) and 2026-05-14 (modified/republication).

Sources and references

Verified primary and authoritative sources

  • CVE-2025-38724 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-38724

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-38724 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-38724

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-134-10.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-032379.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-032379.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-10

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.