PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-39977 Siemens CVE debrief

CVE-2025-39977 is a Linux kernel futex use-after-free in the requeue-PI path that Siemens included in its SIMATIC S7-1500 advisory. The supplied advisory data rates it HIGH (CVSS 7.0) and indicates there is currently no fix, so affected operators should rely on compensating controls until vendor guidance changes.

Vendor
Siemens
Product
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)
CVSS
HIGH 7
CISA KEV
Not listed in stored evidence
Original CVE published
2025-06-10
Original CVE updated
2026-05-14
Advisory published
2025-06-10
Advisory updated
2026-05-14

Who should care

OT/ICS teams running the affected Siemens SIMATIC S7-1500 CPU family, especially environments using the additional GNU/Linux subsystem and any local shell or application-execution features. Security teams responsible for Linux-based embedded controllers should also track this advisory because the underlying bug is in futex handling.

Technical summary

The issue is a race in futex_wait_requeue_pi()/futex_requeue() where a thread can leave without using futex_q::lock_ptr for synchronization, creating a use-after-free risk around futex_q state. The described fix is to read futex_q::task before updating futex_q::requeue_state, using READ_ONCE semantics so the task pointer is captured before the state transition. The advisory references a local attack model (AV:L), low privileges (PR:L), and high impact to confidentiality, integrity, and availability.

Defensive priority

High

Recommended defensive actions

  • Restrict access to the interactive shell of the additional GNU/Linux subsystem to trusted personnel only.
  • Only build and run applications from trusted sources on affected systems.
  • Treat the advisory as a no-fix condition for now and use compensating controls until Siemens publishes corrective guidance.
  • Monitor Siemens ProductCERT SSA-082556 and CISA ICSA-25-162-05 for any future remediation updates.
  • Limit local access to affected devices and review which users or services can reach the embedded Linux environment.

Evidence notes

The source corpus ties this CVE to Siemens advisory SSA-082556 / CISA advisory ICSA-25-162-05, with publication on 2025-06-10 and a latest republication update on 2026-05-14. The revision history shows CVE-2025-39977 was added to the advisory on 2026-01-13, so that later advisory date should not be confused with the CVE's publication date. The supplied data also states 'Currently no fix is available' and provides a CVSS 3.1 vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-39977 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-39977

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-39977 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-39977

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-162-05.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-082556.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-082556.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-05

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.