CVE-2025-39845 Siemens CVE debrief

Who should care

OT operators and maintainers running Siemens SIMATIC CN 4100 systems, Linux kernel/embedded platform teams, and anyone operating 4-level paging systems that use persistent memory, DAX, or memremap_pages()-dependent boot paths.

Technical summary

The fix defines ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() so page tables are properly synchronized when calling p*d_populate_kernel(). In 5-level paging, synchronization occurs through pgd_populate_kernel(); in 4-level paging, pgd_populate() is a no-op, so synchronization must happen at the P4D level via p4d_populate_kernel(). The missing synchronization caused intermittent page faults during __init_single_page() and a crash in vmemmap_set_pmd() when vmemmap was accessed before sync_global_pgds() completed.

Defensive priority

Medium, with higher operational priority for production OT environments where boot failure or kernel crash would cause service interruption.

Recommended defensive actions

• Update to Siemens V5.0 or later as listed in the vendor remediation.
• Confirm whether any deployed SIMATIC CN 4100 systems are running versions earlier than 5.0 and are in scope of SSA-032379 / ICSA-26-134-10.
• Plan the update in a maintenance window and validate system boot and persistent-memory workflows after reboot.
• If you maintain a custom or backported kernel, verify that the page-table synchronization fix is present in the build.
• Monitor affected hosts for boot-time page faults, vmemmap crashes, or other availability symptoms until remediation is complete.

Evidence notes

Timing and advisory context come from the supplied CISA CSAF source item: published 2026-05-12 and republished 2026-05-14 from Siemens ProductCERT advisory SSA-032379. The supplied CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (5.5/Medium), indicating an availability-only impact with local prerequisites. The source text describes intermittent boot failures on 4-level paging systems with large persistent memory and a crash in vmemmap_set_pmd(); the product mapping to Siemens SIMATIC CN 4100 <5.0 is present in the advisory metadata but marked low confidence / needs review. No KEV entry or ransomware campaign use is supplied in the corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.