CVE-2025-39689 Siemens CVE debrief

Who should care

Linux kernel maintainers, distro security teams, and operators of systems that rely on ftrace tracing interfaces. If you consume the supplied CISA/Siemens advisory mapping, verify the product scope carefully because the source metadata and the CVE text do not cleanly align.

Technical summary

According to the source description, readers of set_ftrace_filter and set_ftrace_notrace previously attached a pointer to the global tracer hash to their iterator rather than taking a copy. Because the iterator can outlive lock-held sections while the global tracer hashes may be updated by other code, that shared pointer could become stale, creating a use-after-free or similar memory corruption bug. The resolved change makes reads behave like writes: allocate and copy the hash for the filter-file iterator, removing the lifetime hazard and reducing special-case cleanup logic.

Defensive priority

High. The supplied CVSS vector is 7.8/HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the issue affects kernel memory handling in a core tracing path. Prioritize patch validation on any kernel builds that include the affected ftrace code path, especially where local users may interact with tracing interfaces.

Recommended defensive actions

• Confirm whether your kernel build includes the CVE-2025-39689 ftrace fix for reading set_ftrace_filter and set_ftrace_notrace.
• Apply the vendor or distribution update that copies the tracer hash for filter-file readers.
• Where the supplied advisory mapping applies, update to V5.0 or later as listed in the remediation guidance.
• Verify backport status in your asset inventory so patched and unpatched kernel builds are clearly distinguished.
• Reassess access controls and monitoring around kernel tracing interfaces, especially on systems with local user access.

Evidence notes

Primary evidence comes from the CISA CSAF advisory ICSA-26-134-10 and the embedded CVE text. That text says the reader path for set_ftrace_filter and set_ftrace_notrace reused a pointer to the global tracer hash across lock-releasing calls, which could trigger UAF-like bugs, and that the fix is to allocate and copy the hash for reads. The supplied metadata also associates the advisory with Siemens SIMATIC CN 4100 and a V5.0-or-later remediation, but that product mapping appears inconsistent with the Linux-kernel vulnerability description and should be treated as low-confidence until independently verified. Public timeline in the corpus: initial publication 2026-05-12 and republished 2026-05-14.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.