PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-39800 Siemens CVE debrief

CVE-2025-39800 is a Linux kernel btrfs issue where an unexpected extent buffer generation at btrfs_copy_root() was previously only warned about, rather than causing the transaction to abort. According to the advisory text, that behavior could allow metadata with an unexpected generation to persist. CISA’s advisory for Siemens SIMATIC CN 4100 lists a vendor fix of V5.0 or later. The advisory was first published on 2026-05-12 and republished/updated on 2026-05-14.

Vendor
Siemens
Product
SIMATIC CN 4100
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-14
Advisory published
2026-05-12
Advisory updated
2026-05-14

Who should care

Operators and maintainers of Siemens SIMATIC CN 4100 systems, especially environments running affected firmware/software versions below V5.0. Linux and storage subsystem maintainers should also note the underlying btrfs fix because the issue is in kernel metadata handling.

Technical summary

The vulnerability is a defensive correctness issue in btrfs_copy_root(): when the extent buffer generation is not what the code expects, the prior behavior was to WARN_ON() and continue rather than abort the transaction. The fix changes this to abort the transaction and return -EUCLEAN, reducing the chance that unexpected metadata state is persisted. The supplied CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, with a medium base score of 5.5.

Defensive priority

Medium. Prioritize if the affected Siemens platform is deployed in operational or production environments, since the issue can impact availability and metadata integrity handling in a kernel storage path.

Recommended defensive actions

  • Upgrade Siemens SIMATIC CN 4100 to V5.0 or later, as listed in the supplied remediation.
  • Verify whether any deployed systems match the affected product scope: Siemens SIMATIC CN 4100 versions earlier than V5.0.
  • Track CISA advisory ICSA-26-134-10 and the linked Siemens ProductCERT advisory for any follow-up revisions.
  • If immediate upgrading is not possible, increase change-control scrutiny around filesystem and kernel updates on affected hosts and schedule maintenance as soon as feasible.
  • Use standard ICS defense-in-depth and recommended practices for layered protection and recovery planning.

Evidence notes

All claims are drawn from the supplied CISA CSAF source item and its referenced official links. The source metadata lists the affected product as Siemens SIMATIC CN 4100 versions earlier than V5.0 and a remediation to update to V5.0 or later. The vulnerability description states that btrfs_copy_root() previously warned on unexpected extent buffer generation instead of aborting the transaction and returning -EUCLEAN. The supplied advisory metadata shows publication on 2026-05-12 and an update/republication on 2026-05-14. No KEV entry or threat-campaign field was provided in the corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-39800 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-39800

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-39800 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-39800

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-134-10.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-032379.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-032379.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-10

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.