CVE-2025-39844 Siemens CVE debrief

Who should care

OT operators, system integrators, and patch managers responsible for Siemens SIMATIC CN 4100 devices running versions before V5.0 should review this issue. Linux kernel teams supporting vmemmap, page-table, or device-DAX/persistent-memory code paths should also note the underlying synchronization problem.

Technical summary

The vulnerability is a Linux kernel page-table synchronization bug in the vmemmap population path. The advisory says the crash can occur during boot when initializing the vmemmap (struct page array) if the region spans two PGD entries. In that case, a new PGD entry may be installed in init_mm.pgd but not synchronized into the page tables of other tasks. The failure is observed in a boot-time stack involving __init_single_page(), __init_zone_device_page(), memmap_init_zone_device(), memremap_pages(), devm_memremap_pages(), and dev_dax_probe(). The problem is triggered on the optimized vmemmap path, where vmemmap_can_optimize() leads to vmemmap_populate_compound_pages() and skips the top-level page-table sync that the normal x86 path performs. The described fix moves page-table sync declarations to linux/pgtable.h and introduces kernel-page-table population helpers to make synchronization harder to omit.

Defensive priority

Medium. The published CVSS is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting a local-precondition, availability-only issue. It deserves prompt attention in OT environments because it can prevent successful boot on affected systems.

Recommended defensive actions

• Update affected Siemens SIMATIC CN 4100 systems to V5.0 or later using the vendor remediation path provided in the advisory.
• Confirm whether any deployed systems are running versions before V5.0 and schedule maintenance windows for upgrade and verification.
• After remediation, validate that affected devices boot cleanly and review kernel logs for page-fault or memremap_pages/dev_dax_probe failures.
• If you maintain Linux kernels outside this product line, ensure backports include the page-table synchronization fix for the vmemmap population path.
• Treat unexpected boot failures on systems using persistent memory or device-DAX as a priority operational issue and escalate for vendor support if needed.

Evidence notes

This debrief is based only on the supplied CISA CSAF source item and the referenced Siemens ProductCERT advisory links. The advisory text explicitly describes intermittent boot failures, a page fault in __init_single_page(), the missing top-level page-table synchronization in the optimized vmemmap path, and the remediation to update to V5.0 or later. The provided timeline shows public publication on 2026-05-12 and republication on 2026-05-14.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.