These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2025-39794 is a kernel issue in the Linux ARM Tegra path where normal memcpy is used to write to IRAM, causing KASAN to crash the kernel during boundary checks. In the supplied CISA/Siemens advisory corpus, this issue is mapped to Siemens SIMATIC CN 4100 versions prior to 5.0, with remediation to update to V5.0 or later. The supplied CVSS vector indicates a local, low-privilege attack path with no use [truncated]
CVE-2025-39790 is an industrial-control disclosure centered on Linux kernel MHI completion handling. The advisory says a remote device can send an event whose TRE pointer does not match the host’s expected next ring entry, and stale event data can cause the host to process the wrong transfer range. In the worst case, a buffer may be freed twice when the host follows that stale pointer. Siemens maps the is [truncated]
CVE-2025-39788 is a Linux kernel bug in the ufs-exynos storage driver where a left-shift expression can overflow integer width when the number of UTP transfer request slots is 32. On affected systems, the driver may write the wrong value to UTRL_NEXUS_TYPE, and the same fix was applied for UTMRL_NEXUS_TYPE for consistency. The source advisory also notes a UBSAN shift-out-of-bounds warning. The supplied ad [truncated]
CVE-2025-39782 is an availability issue in the Linux kernel checkpoint path that can cause a soft lockup when jbd2_log_do_checkpoint() runs for too long without an explicit reschedule point. The public advisory was first published on 2026-05-12 and republished on 2026-05-14 with Siemens ProductCERT material. The source advisory maps the issue to Siemens SIMATIC CN 4100 versions before 5.0 and recommends u [truncated]
CVE-2025-39776 describes a Linux kernel mm/debug_vm_pgtable test cleanup bug where manually allocated page-table entries are not cleared at destroy_args(). On a debug kernel with CONFIG_DEBUG_VM_PGTABLE=y, stale entries can be reused by a later mm_struct allocation and cause warnings or incorrect memory-management state. The source advisory was published on 2026-05-12 and republished on 2026-05-14 with Si [truncated]
CVE-2025-39772 covers a Linux kernel hibmc DRM driver error-path flaw. If hibmc load fails, the driver may take a cleanup path that touches mode.config mutexes before they are initialized, which can lead to a NULL pointer access. The documented fix is to return immediately from the failing initialization path instead of entering unload cleanup.
CVE-2025-39766 is a configuration-sensitive Linux kernel networking issue described in CISA’s republished Siemens advisory ICSA-26-134-10. The advisory says cake_enqueue can drop packets after reaching a low buffer_limit but still return NET_XMIT_SUCCESS, which can lead htb_enqueue to call htb_activate with an empty child qdisc and raise a WARNING. Siemens’ listed remediation is to update the affected SIM [truncated]
CVE-2025-39760 is a medium-severity memory-safety issue described in the Linux kernel USB core: usb_parse_ss_endpoint_companion() checked descriptor type before verifying length, which could permit an out-of-bounds read when parsing malformed SuperSpeed endpoint companion descriptors. The supplied CISA CSAF advisory republishes Siemens ProductCERT material as ICSA-26-134-10 and lists remediation for Sieme [truncated]
CVE-2025-39759 is a medium-severity Linux kernel Btrfs issue involving a race between quota disable and quota rescan operations. The race can let one task free qgroup records from fs_info->qgroup_tree while another task is still iterating that tree under fs_info->qgroup_lock, creating a use-after-free condition. The published fix adds locking in btrfs_free_qgroup_config() and prevents starting the rescan [truncated]
CVE-2025-39757 covers a Linux kernel ALSA usb-audio validation flaw affecting UAC3 cluster segment descriptors. According to the source advisory, the issue is that descriptor sizes and buffer bounds were not being validated, which could allow malicious firmware to trigger out-of-bounds access. The CISA CSAF item republishes Siemens ProductCERT advisory SSA-032379 and lists remediation to update to V5.0 or [truncated]
CVE-2025-39752 is a medium-severity availability issue associated in the supplied Siemens/CISA advisory with SIMATIC CN 4100 versions earlier than 5.0. The underlying Linux kernel fix changes ARM Rockchip SMP startup handling so SRAM/trampoline initialization happens only after secondary CPUs are powered down, reducing a rare kernel hang during boot.
CVE-2025-39749 is a Linux kernel RCU data-race issue that can affect kernels built with CONFIG_IRQ_WORK=y, and in some configurations the irq-work handler is used unconditionally. The source advisory says the per-CPU rcu_data->defer_qs_iw_pending field was accessed concurrently by rcu_preempt_deferred_qs_handler() and rcu_read_unlock_special(), triggering a KCSAN data-race report. The vendor-facing adviso [truncated]
CVE-2025-39743 is a high-severity defect described in the Linux kernel JFS code path. According to the supplied advisory text, inode pages may not be truncated when an inode’s hard-link count is 0, which can trigger a BUGON in clear_inode() because nrpages remains greater than 0. The advisory corpus published by CISA on 2026-05-12 and republished on 2026-05-14 includes a Siemens remediation advising updat [truncated]
CVE-2025-39742 describes a Linux kernel RDMA issue in hfi1 where find_hw_thread_mask() could divide the number of online CPUs by num_core_siblings before verifying that the divisor is nonzero. That ordering creates a possible divide-by-zero runtime error and an availability impact consistent with the published CVSS 5.5 (MEDIUM) rating. The vendor guidance in the advisory is to update to V5.0 or later. The [truncated]
CVE-2025-39738 is a Linux kernel btrfs availability issue disclosed in a Siemens advisory republished by CISA on 2026-05-12 and updated on 2026-05-14. The source text says balance/relocation can hit a transaction abort when a partially dropped subvolume is encountered, causing btrfs to fail delayed refs and abort the transaction. The remediation is to reject half-dropped subvolumes earlier and, for affect [truncated]
CVE-2025-39737 is an availability issue in the Linux kernel’s kmemleak cleanup path. According to the supplied advisory text, disabling kmemleak after object-allocation failure can leave __kmemleak_do_cleanup() processing a very large number of objects one by one, which can monopolize CPU time and trigger a soft lockup. The source corpus ties the CVE to Siemens advisory ICSA-26-134-10 / SSA-032379 and map [truncated]
CVE-2025-39736 describes a Linux kernel deadlock in kmemleak handling. The issue arises when a warning path can run while kmemleak_lock is already held, and the warning may re-enter kmemleak through netpoll/netconsole and try to take the same lock again. The result can be a system hang or loss of availability. The fix moves the warning call outside the locked section. The source corpus associates this CVE [truncated]
CVE-2025-39719 is a medium-severity issue described in the Linux kernel’s bno055 IIO/IMU driver. The flaw is a potential out-of-bounds array access in bno055_get_regmask() caused by iterating hw_xlate using the vals array length instead of hw_xlate’s own length. The published fix adds an explicit hw_xlate_len field so the loop uses the correct bound. The source advisory corpus also republishes this under [truncated]
CVE-2025-39718 is a Linux kernel vsock/virtio vulnerability that can lead to an SKB overflow when a guest trusts a packet-header length that has not been validated against the receive buffer. In the CISA-republished Siemens advisory, the issue is tied to Siemens SIMATIC CN 4100 versions earlier than 5.0. The practical risk is memory corruption in guest-side packet handling, which can affect availability a [truncated]
CVE-2025-39716 is a medium-severity Linux kernel parisc vulnerability described in the CISA/Siemens advisory published on 2026-05-12 and republished on 2026-05-14. The flaw involves __get_user() failing to properly probe user read access, which could let user code reach a read-protected address via a system call. The supplied remediation is to update to V5.0 or later for the affected Siemens SIMATIC CN 4100 package.
CVE-2025-39715 is described in the supplied advisory corpus as a Linux kernel PARISC gateway LWS access-check flaw, republished by CISA in Siemens advisory ICSA-26-134-10. The source says the gateway path used load/stbys,e instructions to detect memory-reference interruptions, but those read-access interruptions are only triggered at privilege levels 2 and 3. Because the kernel and gateway page execute at [truncated]
CVE-2025-39714 is a Linux kernel media-driver flaw in usbtv handling that can crash a system when resolution changes while streaming is active. The reported scenario is a TV standard switch from NTSC to PAL during streaming, which increases the resolution in the driver state without resizing the video buffer, leading to an overflow and a crash. The published fix locks resolution changes while streaming an [truncated]
CVE-2025-39713 describes a time-of-check to time-of-use race in the Linux kernel rainshadow-cec interrupt handler. The fix moves the spin lock before the buffer-full check so the check and buffer update happen atomically, preventing concurrent interrupts from overrunning the buffer. The advisory data published by CISA on 2026-05-12 and republished on 2026-05-14 maps the issue to Siemens SIMATIC CN 4100 me [truncated]
CVE-2025-39710 is a medium-severity bounds-checking issue described in the supplied advisory corpus as a packet-size validation flaw in the Linux kernel media: venus path. The advisory text says packet size read from shared memory was not being checked against the number of available words, creating a risk of out-of-bounds memory access. In the supplied product mapping, Siemens SIMATIC CN 4100 versions pr [truncated]
CVE-2025-39709 is a Linux kernel media: venus issue where the interrupt handler may not be fully initialized before the IRQ is registered. If a spurious interrupt arrives in that window, the kernel can dereference a NULL pointer. The supplied advisory notes the condition was observed during system boot on Rb3Gen2. CISA’s published CSAF advisory republishes Siemens ProductCERT guidance and maps the issue t [truncated]
CVE-2025-39706 describes a Linux kernel teardown-order bug in drm/amdkfd where KFD debugfs is destroyed before the process-destroy workqueue finishes. According to the advisory text, that can leave kfd_process_destroy_wq calling kfd_debugfs_remove_process after /sys/kernel/debug/kfd has already been removed, leading to a kernel NULL pointer problem and a system hang. The source advisory places the issue i [truncated]
CVE-2025-39703 describes a denial-of-service condition in Linux kernel HSR handling that can trigger a kernel BUG and crash when a received HSR frame is too short to hold the required HSR tag. In the supplied advisory material, CISA maps the issue to Siemens SIMATIC CN 4100 versions before 5.0 and republishes Siemens ProductCERT guidance. The affected code path can be reached while handling network traffi [truncated]
CVE-2025-39702 is a high-severity timing issue in the Linux kernel’s IPv6 segment routing path. The fix changes MAC comparison to a constant-time helper so attackers cannot use timing differences to learn information. In the supplied advisory corpus, CISA republishes Siemens guidance for SIMATIC CN 4100 systems that include affected software, with remediation to update to V5.0 or later.
CVE-2025-39701 is a firmware-update validation issue described in a CISA-republished Siemens advisory. The advisory text says the driver should use the security-version-number check instead of the runtime version check, because the old logic could cause a firmware update to fail when the update binary has a lower runtime version number than the installed one. Source materials associate the issue with Siem [truncated]
CVE-2025-39694 is a high-severity vulnerability described in the Linux kernel s390/sclp tracing path: a NULL SCCB address is checked after physical-to-virtual translation, which can cause the check to fail when the kernel identity mapping does not start at zero. The result may be incorrect access to the first page of the identity mapping. The supplied advisory set was published by CISA on 2026-05-12 and r [truncated]