CVE-2025-39756 Siemens CVE debrief

Who should care

Linux kernel maintainers, appliance vendors, and operators of Linux-based systems that raise fs.nr_open or RLIMIT_NOFILE, especially environments that run selftests, high-descriptor workloads, or Siemens SIMATIC CN 4100 systems mapped to this advisory.

Technical summary

The source advisory says that when sysctl_nr_open is configured near its maximum, a local process can trigger alloc_fdtable() to request an impractically large fd-table allocation. The reported path can exceed INT_MAX, leading kvmalloc_array()/kvmalloc() to warn and attempt very large allocations; the described remedy is to add a size check in alloc_fdtable() so the operation fails cleanly with -EMFILE instead of emitting the kernel warning. The supplied metadata maps the issue to Siemens SIMATIC CN 4100 vers:intdot/<5.0, but that product mapping should be treated cautiously because the vulnerability text itself is Linux-kernel-specific.

Defensive priority

Medium. The impact is availability-only and requires local conditions, but the trigger is plausible on systems that permit very large file-descriptor limits, and the kernel warning indicates an avoidable resource-intensive failure path.

Recommended defensive actions

• Apply the vendor remediation listed in the advisory: update affected Siemens SIMATIC CN 4100 systems to V5.0 or later.
• Deploy a Linux kernel build that includes the alloc_fdtable() INT_MAX guard described in the advisory.
• Review fs.nr_open and RLIMIT_NOFILE settings and avoid setting them near the maximum unless there is a clear operational need.
• Test any selftests or applications that exercise very high file-descriptor counts in a staging environment before rollout.
• Monitor kernel logs for mm/slub.c and __kvmalloc_node_noprof warnings and investigate systems with unusually high descriptor limits.

Evidence notes

The supplied timeline places public disclosure on 2026-05-12 and a CISA republication on 2026-05-14. The source advisory text states that high fs.nr_open values can cause fd-table allocations to exceed INT_MAX, producing a warning in mm/slub.c, and that the fix is to reject oversized requests in alloc_fdtable() with -EMFILE. The source metadata also contains a product mapping to Siemens SIMATIC CN 4100, but that mapping appears inconsistent with the Linux-kernel description and should be reviewed.

Official resources