CVE-2025-39709 Siemens CVE debrief

Who should care

Operators and maintainers of Siemens SIMATIC CN 4100 systems running versions earlier than 5.0, especially environments that boot frequently or rely on Linux kernel media/codec components. OT defenders and patch managers should also track the advisory because the impact is service disruption during startup rather than data theft.

Technical summary

The flaw is a probe-time race in the Linux kernel’s venus media driver. The IRQ is registered too early relative to hfi_create()/handler setup, so an interrupt can be delivered before the handler state exists. That can lead to a NULL dereference and crash the affected component or system. The advisory and CVSS vector indicate local attack conditions and high availability impact, with no confidentiality or integrity impact stated in the supplied source.

Defensive priority

Medium. The issue is availability-focused and appears most relevant during initialization or boot, but it can still disrupt affected embedded or OT systems. Prioritize if the device model and version match the advisory and if reboot reliability matters operationally.

Recommended defensive actions

• Update Siemens SIMATIC CN 4100 to V5.0 or later, per the vendor remediation in the advisory.
• Verify whether any deployed systems match the affected product/version scope before scheduling maintenance.
• Monitor for boot-time crashes or repeated startup failures that could indicate the race condition is present in the field.
• Use vendor and CISA advisory references to confirm package and firmware status for any integrated Linux kernel components.
• Treat the issue as an availability risk and include it in reboot/change-management testing for affected devices.

Evidence notes

Source corpus states: the Linux kernel vulnerability is resolved by initializing the interrupt handler before registering the interrupt; otherwise a spurious interrupt can cause a NULL dereference. The advisory says the issue was observed during system boot on Rb3Gen2. The supplied CISA CSAF source published on 2026-05-12 and was republished on 2026-05-14 from Siemens ProductCERT SSA-032379. No KEV listing was supplied. Timing context uses the provided CVE published/modified dates.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.