PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-39843 Siemens CVE debrief

CVE-2025-39843 describes a Linux kernel locking flaw that can trigger spinlock recursion and a deadlock/OOPS during timer and slab allocation activity. In the supplied Siemens/CISA advisory, the issue is tied to Siemens SIMATIC CN 4100 versions earlier than 5.0 and is rated HIGH. The defensive takeaway is straightforward: affected deployments should be identified and updated to the vendor-fixed release.

Vendor
Siemens
Product
SIMATIC CN 4100
CVSS
HIGH 7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-14
Advisory published
2026-05-12
Advisory updated
2026-05-14

Who should care

Siemens SIMATIC CN 4100 owners and operators running versions before 5.0, plus OT/ICS teams responsible for Linux-based embedded systems that rely on the affected kernel code paths.

Technical summary

According to the advisory text, set_track_prepare() can be reached from hrtimer_start_range_ns() while holding the per-CPU hrtimer lock. When CONFIG_DEBUG_OBJECTS_TIMERS is enabled, allocation inside set_track_prepare() may implicitly wake kswapd and re-enter the same lock path, causing lock recursion. The fix avoids that implicit wakeup by passing allocation flags without __GFP_KSWAPD_RECLAIM in debug_objects_fill_pool(), and masks out __GFP_DIRECT_RECLAIM in ___slab_alloc() because preemption is disabled there. The advisory includes an example crash trace showing spinlock recursion.

Defensive priority

High for any affected Siemens SIMATIC CN 4100 deployment; prioritize patching because the issue can produce lock recursion, deadlock, and system instability even though the attack vector is local.

Recommended defensive actions

  • Update Siemens SIMATIC CN 4100 to V5.0 or later, per the vendor remediation.
  • Inventory all deployed Siemens SIMATIC CN 4100 systems and confirm whether they are in the affected version range.
  • Treat systems that cannot be immediately updated as higher risk and increase monitoring for crashes, lockups, or unexpected reboots.
  • Use the official Siemens and CISA advisory pages to verify product-specific guidance before maintenance windows.
  • Apply standard ICS defense-in-depth and access-control practices while patching is scheduled.

Evidence notes

The supplied source advisory (ICSA-26-134-10 / SSA-032379) states the issue affects Siemens SIMATIC CN 4100 versions before 5.0 and recommends updating to V5.0 or later. It assigns CVSS 3.1 7.0 HIGH (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The source timeline shows publication on 2026-05-12 and a CISA republication on 2026-05-14. The enrichment data provided does not mark this CVE as KEV.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-39843 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-39843

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-39843 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-39843

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-134-10.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-032379.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-032379.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-10

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.