CVE-2025-39931 Siemens CVE debrief

Who should care

OT/ICS teams running the affected Siemens SIMATIC S7-1500 CPU family, especially operators who allow local shell or application access to the embedded GNU/Linux subsystem; vulnerability managers tracking local denial-of-service risks; and engineers responsible for firmware, subsystem hardening, and recovery planning.

Technical summary

The kernel function af_alg_sendmsg could abort on an error path without clearing ctx->merge, so the next invocation might reuse an invalid merge value from the prior loop. The fix resets ctx->merge to zero early in the loop, preventing stale state from causing a crash. The supplied CVSS vector indicates a local, low-privilege availability issue (AV:L/PR:L/A:H).

Defensive priority

Medium. The impact is availability rather than code execution, but the supplied Siemens advisory states no fix was available in the provided material, so compensating controls matter until remediation is issued.

Recommended defensive actions

• Restrict interactive shell access on the affected GNU/Linux subsystem to trusted personnel only.
• Only install and run applications from trusted sources on the affected systems.
• Track Siemens ProductCERT SSA-082556 and CISA ICSA-25-162-05 for vendor remediation updates.
• Treat unexplained crashes in the embedded Linux subsystem as a priority because the vulnerability can produce a denial of service.
• Apply CISA ICS recommended practices and general defense-in-depth controls for OT systems.
• Validate recovery procedures and maintenance access controls for the affected CPU family.

Evidence notes

The supplied corpus ties CVE-2025-39931 to CISA ICS advisory ICSA-25-162-05 and Siemens ProductCERT advisory SSA-082556. The advisory was published on 2025-06-10 and last updated on 2026-05-14. The description states that an error in af_alg_sendmsg can leave ctx->merge with garbage from a previous loop and cause a crash on the next entry. The remediation section in the supplied source says there is currently no fix available and recommends restricting shell access and using trusted sources. The corpus does not report KEV listing or active exploitation.

Official resources