CVE-2025-39706 Siemens CVE debrief

Who should care

Administrators, operators, and maintenance teams responsible for Siemens SIMATIC CN 4100 systems covered by ICSA-26-134-10, especially where the affected Linux kernel path is present and AMD KFD/debugfs functionality is enabled.

Technical summary

The advisory says the fix is to move kfd_process_destroy_wq before kfd_debugfs_fini. The failure occurs when debugfs_remove_recursive(entry->proc_dentry) tries to remove /sys/kernel/debug/kfd/proc/<pid> after /sys/kernel/debug/kfd has already been removed. The stated effect is a kernel NULL pointer condition that can hang the system. The supplied CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating a local, low-privilege availability issue rather than a confidentiality or integrity impact.

Defensive priority

Medium. This is a local availability issue, but a kernel hang on an operational platform can still be disruptive and should be remediated promptly during normal maintenance windows.

Recommended defensive actions

• Update affected Siemens SIMATIC CN 4100 systems to V5.0 or later, as directed in the vendor remediation.
• Confirm whether your deployed hardware/software stack matches the affected product/version scope in ICSA-26-134-10.
• Schedule maintenance to apply the fix and validate that kernel teardown paths no longer trigger hangs or NULL pointer failures.
• Monitor for unexplained kernel hangs or crashes involving KFD/debugfs teardown behavior on affected hosts.
• Treat the issue as defense-in-depth rather than a known exploited vulnerability; no KEV entry is listed in the supplied data.

Evidence notes

The supplied CISA CSAF advisory (ICSA-26-134-10) and Siemens ProductCERT references state that the issue is resolved by moving kfd_process_destroy_wq before kfd_debugfs_fini. The description explicitly says /sys/kernel/debug/kfd may already be gone when kfd_debugfs_remove_process runs, causing a kernel NULL pointer problem and hang. The remediation in the supplied corpus is to update to V5.0 or later. The provided CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The vendor/product mapping in the input is marked low confidence, so the product scope should be validated against the official Siemens advisory before operational decisions are made.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.