CVE-2025-39819 Siemens CVE debrief

Who should care

Operators and maintainers responsible for systems covered by the Siemens advisory ICSA-26-134-10 / SSA-032379, especially environments running Siemens SIMATIC CN 4100 versions earlier than 5.0. Linux kernel SMB/CIFS maintainers and defenders monitoring kernel resource leaks should also review it. The vendor mapping in the corpus is low-confidence and should be validated before broad operational assumptions are made.

Technical summary

The source describes a reference-count mismatch in smb2_compound_op. The function comment indicates the cfile reference must be dropped after the call, and the patched path restores that cleanup by adding a goto out label so the cleanup logic is reached consistently. The issue is tied to allocation failure for vars; in that case, existing callers would not otherwise account for the cfile refcount update when -ENOMEM occurs. The advisory also notes that -ENOMEM is not recoverable according to is_replayable_error, so replay handling is skipped.

Defensive priority

Medium. The reported impact is availability-oriented resource leakage rather than direct code execution or integrity compromise, and the CVSS vector in the source is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. Prioritize if the affected Siemens product mapping applies to your environment or if you rely on the impacted Linux SMB code path.

Recommended defensive actions

• Apply the vendor remediation from the advisory: update to V5.0 or later for the affected Siemens product line named in the source corpus.
• Review whether any deployed systems match the advisory scope in ICSA-26-134-10 / SSA-032379 before scheduling maintenance.
• Monitor affected hosts for signs of repeated resource exhaustion or instability associated with SMB/CIFS operations.
• Validate the vendor/product mapping in your asset inventory, because the supplied corpus marks the vendor confidence as low and needs review.
• Track the linked CISA and Siemens advisories for any follow-up revisions or clarifications.

Evidence notes

All substantive statements here are drawn from the supplied source corpus and linked official references. The corpus contains a Linux kernel SMB refcount cleanup description, while the vendor metadata maps the advisory to Siemens SIMATIC CN 4100 vers:intdot/<5.0 with low confidence and needsReview=true. Timing uses the supplied published/modified dates: 2026-05-12 initial publication and 2026-05-14 republication/modify date. No exploit details beyond the advisory summary are included.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.