CVE-2025-39681 Siemens CVE debrief

Who should care

Linux kernel maintainers, distro and embedded Linux operators using Hygon x86 CPUs, and teams responsible for boot reliability on systems that expose resctrl/CQM monitoring features.

Technical summary

The supplied CVE text says resctrl_cpu_detect() was moved into vendor-specific BSP initialization code, but the Hygon path did not include that call. On affected Hygon systems with X86_FEATURE_CQM* support, get_rdt_mon_resources() may read boot_cpu_data.x86_cache_occ_scale before it is initialized and then divide by zero while calculating mon_l3_config. The provided CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating a local, availability-focused issue.

Defensive priority

Medium. Prioritize patching if you run Linux on Hygon-based x86 hardware with resctrl/CQM features enabled, especially where a boot failure would disrupt production or recovery access.

Recommended defensive actions

• Apply the upstream Linux kernel fix that restores resctrl_cpu_detect() in the Hygon BSP init path.
• Upgrade to a kernel build that includes the resolved patch and verify normal boot on representative affected hardware.
• If you operate Hygon-based systems in production, stage the update and ensure console or out-of-band recovery access before rollout.
• Review whether your deployed kernels and hardware actually expose X86_FEATURE_CQM* and resctrl features so you can scope exposure accurately.

Evidence notes

The supplied source item and CVE description both state that the issue is in the Linux kernel and that the failure is triggered during early boot when Hygon-specific BSP init omits resctrl_cpu_detect(). The corpus also includes a CISA/CSAF advisory record with a Siemens SIMATIC CN 4100 product label and a Siemens remediation pointer, but that product mapping conflicts with the Linux-kernel Hygon description. Because of that mismatch, this debrief treats the CVE text as the authoritative technical description and flags the vendor/product mapping as low confidence and needing review. The supplied data shows no KEV listing.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.