PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-39828 Siemens CVE debrief

CVE-2025-39828 describes a Linux kernel ATM subsystem flaw in atmtcp_recv_control() where sendmsg()-originated messages were not adequately validated before reaching control handling. The advisory states this could let a local attacker abuse atmtcp_control handling to overwrite kernel pointers, which is why the issue was fixed by adding a pre_send() validation step. In the Siemens/CISA advisory set, the issue is associated with Siemens SIMATIC CN 4100 versions prior to 5.0, but the product mapping is marked low-confidence and should be reviewed before operational use.

Vendor
Siemens
Product
SIMATIC CN 4100
CVSS
HIGH 7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-14
Advisory published
2026-05-12
Advisory updated
2026-05-14

Who should care

Asset owners and operators using Siemens SIMATIC CN 4100 appliances or other deployments that include the affected Linux kernel ATM/atmtcp code path should care, especially teams responsible for patching, firmware validation, and local privilege-risk reduction.

Technical summary

The reported bug is in drivers/atm/atmtcp.c. The kernel uses a special atmtcp_control structure for both in-kernel and user-facing message flows. The advisory says vcc_sendmsg() could reach atmtcp_recv_control() without sufficient message-length validation, allowing a local sender to drive an arbitrary write against kernel pointer data. The fix introduces a new pre_send() hook so messages from sendmsg() are validated before they can reach the vulnerable control path.

Defensive priority

High. The supplied CVSS vector is AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack that can still have full confidentiality, integrity, and availability impact if the affected path is reachable.

Recommended defensive actions

  • Update affected Siemens SIMATIC CN 4100 systems to V5.0 or later, per the vendor remediation note.
  • Confirm whether your deployed firmware or kernel build includes the affected ATM/atmtcp code path.
  • Limit local shell and application access on systems that expose the vulnerable kernel surface.
  • Track Siemens ProductCERT advisory SSA-032379 and the CISA advisory ICSA-26-134-10 for vendor-specific remediation details.
  • Validate that patching does not break any ATM-related functionality used by your deployment.

Evidence notes

Source corpus states that the issue was published by CISA on 2026-05-12 and republished on 2026-05-14 from Siemens ProductCERT SSA-032379. The advisory text explicitly says the problem is in the Linux kernel ATM atmtcp control path and that a new pre_send() hook was added to validate sendmsg() messages. The supplied advisory also lists the remediation as updating to V5.0 or later and provides CVSS 3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The product association 'Siemens SIMATIC CN 4100 vers:intdot/<5.0' is marked low confidence and needs review.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-39828 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-39828

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-39828 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-39828

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-134-10.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-032379.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-032379.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-10

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.