CVE-2025-39691 Siemens CVE debrief

Who should care

Administrators of Siemens SIMATIC CN 4100 systems, OT/ICS security teams, and anyone responsible for Linux kernel maintenance on affected devices should review this issue. It is most relevant where privileged local access exists and filesystem mount activity may reach the vulnerable code path.

Technical summary

The advisory says the Linux kernel fs/buffer fix addresses a lifetime bug when calling bh_read(). In the reported NTFS3 mount scenario, mpage_read_folio() passes a stack buffer_head (map_bh) into ntfs_get_block_vbo(), and later end_buffer_read_sync() may call put_bh() after the stack object is no longer valid, producing a use-after-free/stack-out-of-bounds condition. The notes also state that if the buffer head belongs to a folio, drop_buffers() will not free locked buffers, which is why the fix moves put_bh() before __end_buffer_read_notouch(). CISA’s CSAF maps the advisory to Siemens SIMATIC CN 4100 vers:intdot/<5.0 and lists CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H.

Defensive priority

Medium. The flaw is locally reachable and requires high privileges, but it affects a kernel code path on an OT-related product line and can cause system instability or denial of service.

Recommended defensive actions

• Update Siemens SIMATIC CN 4100 to V5.0 or later, per the vendor remediation.
• Verify asset inventories to confirm whether any deployed systems match the affected product/version mapping before scheduling maintenance.
• Restrict and monitor privileged local access on affected systems because the advisory’s attack vector is local and requires high privileges.
• Prioritize patching where filesystem mount operations are operationally important or where a kernel crash would disrupt production.
• Track Siemens and CISA advisory updates for any product-mapping clarifications or follow-on guidance.

Evidence notes

The supplied CSAF source (ICSA-26-134-10, republished by CISA on 2026-05-14) states that the Linux kernel issue occurs during NTFS3 mount processing and can lead to a KASAN-detected stack out-of-bounds condition in end_buffer_read_sync(). The same source notes the fix is to call put_bh() before __end_buffer_read_notouch() and recommends updating Siemens SIMATIC CN 4100 to V5.0 or later. The supplied CVSS vector is CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H (4.4). No KEV entry is present in the supplied enrichment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.