PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-38728 Siemens CVE debrief

CVE-2025-38728 is a Linux kernel SMB3/ksmbd memory-safety flaw that can trigger a slab out-of-bounds read during mount operations. In the supplied Siemens/CISA advisory, the affected product mapping is Siemens SIMATIC CN 4100 versions before 5.0, with remediation to update to V5.0 or later. The advisory rates the issue as CVSS 5.5/Medium and frames the impact as availability-focused rather than confidentiality or integrity compromise.

Vendor
Siemens
Product
SIMATIC CN 4100
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-14
Advisory published
2026-05-12
Advisory updated
2026-05-14

Who should care

Operators and administrators responsible for Siemens SIMATIC CN 4100 deployments, especially systems that rely on SMB3/CIFS mount paths and ksmbd-related kernel code. Linux platform teams that build, ship, or maintain affected kernels should also review their update posture, even if the immediate advisory is framed for an OT product.

Technical summary

The advisory describes a missing bounds check in parse_server_interfaces() in the Linux kernel cifs/SMB3 code path. With KASAN enabled, a mount to ksmbd can reach a slab out-of-bounds read in parse_server_interfaces(), which in the supplied report occurs during SMB3_request_interfaces() and the mount flow. The reported CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating a local, low-privilege condition with high availability impact.

Defensive priority

Medium

Recommended defensive actions

  • Update affected Siemens SIMATIC CN 4100 systems to V5.0 or later, per the vendor remediation guidance.
  • Validate whether your environment uses SMB3/CIFS mount paths or ksmbd-related functionality that could exercise the affected code path.
  • Prioritize patching in maintenance windows for exposed OT assets, since the advisory indicates availability impact.
  • Review asset inventories and confirm which deployed versions fall below the fixed release threshold.
  • Monitor Siemens and CISA advisory updates for any revision history or follow-on guidance.

Evidence notes

The supplied source corpus is a CISA CSAF advisory republising Siemens ProductCERT SSA-032379 for CVE-2025-38728, published 2026-05-12 and republished 2026-05-14. The corpus states the issue is a Linux kernel smb3 fix for a slab out-of-bounds condition in parse_server_interfaces(), and the remediation is to update to V5.0 or later. The enrichment marks the issue as not known to be in CISA KEV.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-38728 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-38728

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-38728 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-38728

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-134-10.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-032379.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-032379.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-10

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.