These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2025-38695 is a Linux kernel null pointer dereference in the scsi: lpfc cleanup path. The advisory says a failed lpfc_sli4_read_rev() call can lead to cleanup running before sli4_hba.hdwqs are allocated, and the code may then try to access the first hardware queue's lock through a null hdwq pointer. The published fix is a null check with an early return.
CVE-2025-38694 describes a NULL pointer dereference in the Linux kernel media/dvb-frontends dib7090p_rw_on_apb() path. The advisory text says user-controlled msg data can bypass earlier buffer checks when msg[0].buf is null and msg[0].len is zero, leading to a crash when later code reads msg[0].buf[2], with a similar issue for msg[1].buf[0] and msg[1].buf[1]. In the supplied CISA CSAF source, this CVE is [truncated]
CVE-2025-38693 is a kernel crash issue in the Linux media stack: the w7090p tuner write/read serpar paths could dereference a null buffer when message length is zero. The advisory describes a fix that adds a length check before accessing message data. CISA published the advisory on 2026-05-12 and republishes it on 2026-05-14 with Siemens ProductCERT material. The source record’s product labeling is low-co [truncated]
CVE-2025-38687 is a race condition in the Linux kernel comedi driver that can lead to a use-after-free when a device is detached while poll requests are still queued. The supplied advisory context maps the issue to Siemens SIMATIC CN 4100 versions before 5.0, and the source description says the fix is to keep the device attach lock held while checking for sleepers and detaching.
CVE-2025-38684 is described in the supplied advisory material as a Linux kernel net/sched ets issue that can trigger a NULL pointer dereference during qdisc changes and class cleanup. The fix is to purge idle DWRR queues before updating q->nbands, so ets_class_find() and ets_class_is_strict() operate on a consistent configuration. The source package republished by CISA on 2026-05-14 points to Siemens advi [truncated]
CVE-2025-38683 describes a Linux kernel panic in the hv_netvsc networking path when a VF is moved back to the default namespace during network-namespace deletion. The supplied advisory text says the list of network devices can be modified while default_device_exit_net() is iterating, leading to a NULL pointer dereference and system crash. The stated fix is to defer the namespace change to a workqueue and [truncated]
CVE-2025-38681 is a race condition in Linux kernel ptdump page-table inspection paths. During memory hot-remove, kernel page tables can change while ptdump_walk_pgd() or ptdump_check_wx() is reading them. In the worst case, freed intermediate page-table memory can be reused, letting the dump code dereference stale pointers and potentially crash or otherwise misbehave. The provided advisory data ties the i [truncated]
CVE-2025-38680 describes a 1-byte out-of-bounds read in the Linux kernel’s uvcvideo path. The advisory explains that uvc_parse_format() could read buffer[3] after only checking for a 3-byte minimum, so inputs with exactly 3 bytes could trigger an out-of-bounds read. The cited fix is to require at least 4 bytes before parsing. In the supplied CISA CSAF source, this issue is republished in the context of Si [truncated]
CVE-2025-38679 describes an out-of-bounds read in the Linux kernel’s media: venus path when parsing a firmware-supplied property list without first validating the remaining payload length. The issue can lead to kernel crashes and, depending on what is read past the buffer, possible information exposure. The supplied advisory metadata ties this CVE to Siemens SIMATIC CN 4100 versions below 5.0, but the vul [truncated]
CVE-2025-38677 describes an out-of-boundary access in the Linux kernel F2FS path, specifically during dnode handling in f2fs_get_dnode_of_data(). The advisory text says a corrupted image can cause a dnode to be parsed as an inode node, leading to an invalid block-address calculation and an out-of-bounds access. The fix adds a sanity check for node IDs of direct nodes during dnode lookup. The source adviso [truncated]
CVE-2025-38676 is a Linux kernel memory-safety issue in the amd IOMMU path that can write one byte past the end of the acpiid buffer when processing a maximum-length command-line string. The advisory maps the issue to Siemens SIMATIC CN 4100 systems earlier than V5.0 and recommends upgrading to V5.0 or later.
CVE-2025-38670 is a Linux kernel arm64 entry-path flaw that can leave the task stack and Shadow Call Stack out of sync if an interrupt lands during stack switching. The source advisory says this can clobber stack state and lead to kernel panics or other availability failures. In the supplied advisory metadata, Siemens maps the issue to SIMATIC CN 4100 versions prior to 5.0 and recommends updating to V5.0 or later.
CVE-2025-38552 is described in the supplied source as a Linux kernel MPTCP race condition fix that prevents races between subflow failure and additional subflow creation. The advisory context provided by CISA maps the issue to Siemens SIMATIC CN 4100 vers:intdot/<5.0, with remediation to update to V5.0 or later. Because the source metadata and the vulnerability description do not align cleanly, this recor [truncated]
CVE-2025-38502 is a Linux kernel BPF issue that can lead to out-of-bounds access in cgroup local storage handling when a tail call switches between programs using different storage sizes. The supplied CISA/Siemens advisory maps the issue to Siemens SIMATIC CN 4100 versions before 5.0 and recommends updating to V5.0 or later. The source corpus does not indicate known exploitation or KEV listing.
CVE-2025-38491 is a Linux kernel MPTCP fallback handling flaw that was reported by Syzkaller and resolved by making the fallback action and fallback decision atomic. The supplied advisory data associates the CVE with a Siemens SIMATIC CN 4100 product record, but the technical description itself points to the Linux kernel networking stack, so the product mapping should be verified before scoping remediatio [truncated]
CVE-2025-38347 is described in the supplied source as a Linux kernel f2fs flaw where corrupted inode/xattr metadata can cause the same inode page to be locked twice during ACL and xattr handling, leading to a hang or deadlock and a denial-of-service condition. The supplied advisory metadata also maps the issue to Siemens SIMATIC CN 4100 versions earlier than 5.0, but that product attribution does not alig [truncated]
CVE-2025-38322 describes a Linux kernel regression in perf/x86/intel that can trigger a crash or hard lockup when topdown/perf metrics code runs on Intel Raptor Lake E-core CPUs that do not support the perf metrics feature. The supplied advisory says the bug came from a mistaken use of is_topdown_event() instead of is_topdown_count(), and it was fixed by correcting when icl_update_topdown_event() is invok [truncated]
CVE-2025-37968 is an availability issue in the Linux kernel’s opt3001 light sensor driver that can deadlock a threaded IRQ path if a shared flag changes between two reads. In the supplied Siemens/CISA advisory context, the recommended remediation is to update to V5.0 or later.
CVE-2025-37931 is a medium-severity integrity issue with operational impact: a btrfs subpage bitmap bug can cause dirty metadata blocks to be skipped during writeout, which may lead to tree log corruption and broader filesystem corruption. The supplied advisory text describes the problem on systems using 64k page size, 16k nodesize, and 4k sectorsize, but the source metadata also associates the CVE with S [truncated]
CVE-2025-31257 is a medium-severity advisory record in the supplied corpus that points to Siemens SIMATIC CN 4100 versions earlier than V5.0. The vendor remediation is to update to V5.0 or later. The source text says the issue was addressed with improved memory handling and that processing maliciously crafted web content may lead to an unexpected crash. The supplied metadata also contains a product/descri [truncated]
CVE-2025-23143 is a Linux kernel availability issue tied to CIFS socket teardown and lockdep lock-class handling. Under the conditions described in the advisory, the CIFS module can be unloaded while a TCP socket is still alive in FIN_WAIT_1, and later socket activity can cause lockdep to access module-owned lock-class metadata that no longer exists. The result is a warning followed by a NULL pointer dere [truncated]
CVE-2025-22871 is a critical request smuggling issue in the Go net/http package. The flaw is that net/http improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. According to the supplied CISA/Siemens advisory material, impact is most relevant when a net/http server is chained with another server that incorrectly accepts a bare LF as part of a chunk extension, creating parser [truncated]
CVE-2025-12659 affects Siemens Simcenter Femap and was published by CISA on 2026-05-12, with a republication update on 2026-05-14. The issue is a memory corruption vulnerability in IPT file parsing that could allow code execution in the context of the current process. The advisory’s CVSS 3.1 vector indicates local access and user interaction are required, and the overall severity is High (7.8). Siemens st [truncated]
CVE-2025-0395 describes a buffer overflow risk in the GNU C Library assert() failure path when the assertion message size aligns with page size. In the CISA-republished Siemens advisory, the issue is associated with multiple RUGGEDCOM ROX products, and Siemens recommends updating to V2.17.1 or later. The CVSS v3.1 vector indicates a locally exploitable availability issue with no confidentiality or integrity impact.
CVE-2024-57258 is a high-severity integer-overflow flaw in Das U-Boot that Siemens republished for multiple RUGGEDCOM ROX models. According to the CISA CSAF advisory, a crafted squashfs filesystem can trigger faulty memory allocation paths in U-Boot before 2025.01-rc1, including sbrk/request2size handling and a ptrdiff_t issue on x86_64. Siemens' published remediation is to update the affected products to [truncated]
CVE-2024-57256 describes an integer overflow in Das U-Boot’s ext4fs_read_symlink path when processing a crafted ext4 filesystem. According to the advisory, an inode size of 0xffffffff can cause a zalloc size calculation to wrap, resulting in a zero-byte allocation and a memory overwrite. Siemens lists affected RUGGEDCOM ROX devices and provides a fix in V2.17.1 or later.
CVE-2024-54017 describes insufficient randomness in session identifier generation on affected Siemens SIPROTEC 5 devices. An unauthenticated remote attacker could brute-force a valid session identifier and read limited information exposed by the web server without authorization. The supplied advisory corpus rates this as medium severity and ties it to a network-reachable information-disclosure condition r [truncated]
CVE-2024-47704 is a medium-severity availability issue in the Linux kernel's drm/amd/display path. The source advisory says dp_enable_link_phy and dp_disable_link_phy can pass link_res without initializing hpo_dp_link_enc, so a null-pointer check is needed before dereference. The published CVSS is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which fits a local, availability-only defect. The advisory data al [truncated]
CISA republished Siemens ProductCERT advisory SSA-827383 for CVE-2024-4367 on 2026-05-12 and updated it on 2026-05-14. The supplied record says a missing type check when handling fonts in PDF.js could allow arbitrary JavaScript execution in the PDF.js context, but the advisory metadata maps the issue to Siemens Teamcenter version ranges. Siemens remediation entries in the source call for updating Teamcent [truncated]
CVE-2024-3447 affects QEMU’s SDHCI device emulation and can be triggered by a malicious guest to crash the host-side QEMU process. In the supplied Siemens/CISA advisory context, the issue is relevant to Siemens RUGGEDCOM ROX devices and is remediated by updating to V2.17.1 or later. The primary risk is availability: an attacker able to exercise the vulnerable guest path may cause a host denial of service.