CVE-2025-39848 Siemens CVE debrief

Who should care

Operators and maintainers responsible for Siemens SIMATIC CN 4100 systems on versions earlier than V5.0, especially environments that rely on the affected Linux kernel networking path. Security teams should also note the local-access, availability-focused risk profile from the CVSS vector.

Technical summary

The advisory describes a bug in ax25_kiss_rcv() where input skbs may be modified while still shared. That unsafe handling can corrupt packet state; after the netns packet-chain change referenced in the advisory, skb->dev may become NULL and the kernel can crash in __netif_receive_skb_core(). The published CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating a local, low-privilege denial-of-service condition with no stated confidentiality or integrity impact.

Defensive priority

Medium. Prioritize remediation if you run the affected Siemens product branch or any deployment that depends on the vulnerable AX.25 kernel path; otherwise track it as a localized availability risk.

Recommended defensive actions

• Update Siemens SIMATIC CN 4100 to V5.0 or later as specified in the advisory.
• Inventory where the affected product or kernel branch is deployed before scheduling maintenance.
• Treat the issue as a local denial-of-service risk and review local-privilege exposure on affected systems.
• If AX.25 is not required in your environment, disable or avoid exposing that path where operationally feasible.
• Monitor affected systems for kernel crashes or unexpected service interruptions until remediation is complete.

Evidence notes

The source corpus includes the Linux-kernel vulnerability description, the CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, the CISA CSAF advisory metadata, and Siemens remediation guidance to update to V5.0 or later. The advisory metadata maps the issue to Siemens SIMATIC CN 4100 vers:intdot/<5.0, but the vulnerability text itself describes an AX.25 Linux kernel bug; that product-scoping linkage should be treated as advisory-scoped context from the supplied source, not independently verified here. Published date context is 2026-05-12 with a source republication/revision on 2026-05-14.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.