Republished vendor advisory. This ICSA is a verbatim republication of Siemens ProductCERT SSA-503939 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA…
General Recommendations: As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources: For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Credit: Siemens ProductCERT
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2024-41049 | CWE-416 Use After Free | 7.8 High |
CVE-2024-41049 In the Linux kernel, the following vulnerability has been resolved: filelock: fix potential use-after-free in posix_lock_inode Light Hsieh reported a KASAN UAF warning in trace_posix_lock_inode(). The request pointer had been changed earlier to point to a lock entry that was added to the inode's list. However, before the tracepoint could fire, another task raced in and freed that lock. Fix this by moving the tracepoint inside the spinlock, which should ensure that this doesn't happen. No fix available: Currently no fix is available Workaround: Only build and run applications from trusted sources Affected, fixed & timelineAffected:
|
| CVE-2024-42161 | CWE-457 Use of Uninitialized Variable | 7.8 High |
CVE-2024-42161 In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD. No fix available: Currently no fix is available Workaround: Only build and run applications from trusted sources Affected, fixed & timelineAffected:
|
| CVE-2024-26982 | CWE-125 Out-of-bounds Read | 7.1 High |
CVE-2024-26982 In the Linux kernel, the following vulnerability has been resolved: Squashfs: check the inode number is not the invalid value of zero No fix available: Currently no fix is available Workaround: Only build and run applications from trusted sources Affected, fixed & timelineAffected:
|
| CVE-2025-21647 | CWE-125 Out-of-bounds Read | 7.1 High |
CVE-2025-21647 In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: add bounds checks to host bulk flow fairness counts No fix available: Currently no fix is available Workaround: Only build and run applications from trusted sources Affected, fixed & timelineAffected:
|
| CVE-2025-21703 | CWE-416 Use After Free | 7.0 High |
CVE-2025-21703 netem: Update sch q.qlen before qdisc_tree_reduce_backlog() qdisc_tree_reduce_backlog() notifies parent qdisc only if child qdisc becomes empty, therefore we need to reduce the backlog of the child qdisc before calling it. Otherwise it would miss the opportunity to call cops qlen_notify(), in the case of DRR, it resulted in UAF since DRR uses qlen_notify() to maintain its active list. No fix available: Currently no fix is available Workaround: Only build and run applications from trusted sources Affected, fixed & timelineAffected:
|
| CVE-2025-8058 | CWE-415 Double Free | 7.0 High |
CVE-2025-8058 The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library. No fix available: Currently no fix is available Workaround: Only build and run applications from trusted sources Affected, fixed & timelineAffected:
|
| CVE-2024-41046 | CWE-415 Double Free | 5.5 Medium |
CVE-2024-41046 In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix double free in detach The number of the currently released descriptor is never incremented which results in the same skb being released multiple times. No fix available: Currently no fix is available Workaround: Only build and run applications from trusted sources Affected, fixed & timelineAffected:
|
| CVE-2024-41055 | CWE-476 NULL Pointer Dereference | 5.5 Medium |
CVE-2024-41055 In the Linux kernel, the following vulnerability has been resolved: mm: prevent derefencing NULL ptr in pfn_section_valid() Commit 5ec8e8ea8b77 ("mm/sparsemem: fix race in accessing memory_section->usage") changed pfn_section_valid() to add a READ_ONCE() call around "ms->usage" to fix a race with section_deactivate() where ms->usage can be cleared. The READ_ONCE() call, by itself, is not enough to prevent NULL pointer dereference. We need to check its value before dereferencing it. No fix available: Currently no fix is available Workaround: Only build and run applications from trusted sources Affected, fixed & timelineAffected:
|
| CVE-2024-42154 | CWE-805 Buffer Access with Incorrect Length Value | 5.5 Medium |
CVE-2024-42154 In the Linux kernel, the following vulnerability has been resolved: tcp_metrics: validate source addr length I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 is at least 4 bytes long, and the policy doesn't have an entry for this attribute at all (neither does it for IPv6 but v6 is manually validated). No fix available: Currently no fix is available Workaround: Only build and run applications from trusted sources Affected, fixed & timelineAffected:
|
| CVE-2024-57940 | CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') | 5.5 Medium |
CVE-2024-57940 exfat: fix the infinite loop in exfat_readdir() If the file system is corrupted so that a cluster is linked to itself in the cluster chain, and there is an unused directory entry in the cluster, dentry will not be incremented, causing condition dentry < max_dentries unable to prevent an infinite loop. This infinite loop causes s_lock not to be released, and other tasks will hang, such as exfat_sync_fs(). No fix available: Currently no fix is available Workaround: Only build and run applications from trusted sources Affected, fixed & timelineAffected:
|
| CVE-2024-57981 | CWE-476 NULL Pointer Dereference | 5.5 Medium |
CVE-2024-57981 usb: xhci: NULL pointer dereference on certain command aborts. If a command is queued to the final usable TRB of a ring segment, the enqueue pointer is advanced to the subsequent link TRB and no further. If the command is later aborted, when the abort completion is handled the dequeue pointer is advanced to the first TRB of the next segment. If no further commands are queued, xhci_handle_stopped_cmd_ring() sees the ring pointers unequal and assumes that there is a pending command, so it calls xhci_mod_cmd_timer() which crashes if cur_cmd was NULL. No fix available: Currently no fix is available Workaround: Only build and run applications from trusted sources Affected, fixed & timelineAffected:
|
| CVE-2024-58005 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-58005 tpm: Change to kvalloc() in eventlog/acpi.c. No fix available: Currently no fix is available Workaround: Only build and run applications from trusted sources Affected, fixed & timelineAffected:
|
| CVE-2025-21678 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2025-21678 gtp: Destroy device along with udp socket's netns dismantle No fix available: Currently no fix is available Workaround: Only build and run applications from trusted sources Affected, fixed & timelineAffected:
|
| CVE-2025-21762 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2025-21762 In the Linux kernel, the following vulnerability has been resolved: arp: use RCU protection in arp_xmit() arp_xmit() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF. No fix available: Currently no fix is available Workaround: Only build and run applications from trusted sources Affected, fixed & timelineAffected:
|
| CVE-2025-21806 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2025-21806 net: let net.core.dev_weight always be non-zero. The following problem was encountered during stability test: (NULL net_device). No fix available: Currently no fix is available Workaround: Only build and run applications from trusted sources Affected, fixed & timelineAffected:
|
| CVE-2025-21826 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2025-21826 netfilter: nf_tables: reject mismatching sum of field_len with set key length. The field length description provides the length of each separated key field in the concatenation, each field gets rounded up to 32-bits to calculate the pipapo rule width from pipapo_init(). The set key length provides the total size of the key aligned to 32-bits. Register-based arithmetics still allows for combining mismatching set key length and field length description, eg. set key length 10 and field description [ 5, 4 ] leading to pipapo width of 12. No fix available: Currently no fix is available Workaround: Only build and run applications from trusted sources Affected, fixed & timelineAffected:
|
| CVE-2024-53124 | CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | 4.7 Medium |
CVE-2024-53124 net: fix data-races around sk sk_forward_alloc. No fix available: Currently no fix is available Workaround: Only build and run applications from trusted sources Affected, fixed & timelineAffected:
|
| CVE-2025-21653 | CWE-20 Improper Input Validation | 4.7 Medium |
CVE-2025-21653 net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute No fix available: Currently no fix is available Workaround: Only build and run applications from trusted sources Affected, fixed & timelineAffected:
|
| CVE-2025-21776 | CWE-476 NULL Pointer Dereference | 4.4 Medium |
CVE-2025-21776 USB: hub: Ignore non-compliant devices with too many configs or interfaces. A test program can cause usb_hub_to_struct_hub() to dereference a NULL or inappropriate pointer. No fix available: Currently no fix is available Workaround: Only build and run applications from trusted sources Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2024-41046 | 8.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix double free in detach The number of the current… |
| CVE-2024-41049 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: filelock: fix potential use-after-free in posix_lock_inode Light Hsieh reported… |
| CVE-2025-21678 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: gtp: Destroy device along with udp socket's netns dismantle. gtp_newlink() link… |
| CVE-2025-21703 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() qdisc_tree_reduce_… |
| CVE-2025-21762 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: arp: use RCU protection in arp_xmit() arp_xmit() can be called without RTNL or … |
| CVE-2025-21826 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject mismatching sum of field_len with set key length T… |
| CVE-2024-53124 | 7.5 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: fix data-races around sk->sk_forward_alloc Syzkaller reported this warning… |
| CVE-2025-21647 | 7.3 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: add bounds checks to host bulk flow fairness counts Even thoug… |
| CVE-2025-8058 | 5.9 Medium | The GNU C Library glibc The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accompl… |
| CVE-2024-26982 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: Squashfs: check the inode number is not the invalid value of zero Syskiller has… |
| CVE-2024-41055 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: mm: prevent derefencing NULL ptr in pfn_section_valid() Commit 5ec8e8ea8b77 ("m… |
| CVE-2024-42154 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: tcp_metrics: validate source addr length I don't see anything checking that TCP… |
| CVE-2024-42161 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD [Changes from V1: - U… |
| CVE-2024-57940 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: exfat: fix the infinite loop in exfat_readdir() If the file system is corrupted… |
| CVE-2024-57981 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix NULL pointer dereference on certain command aborts If a command … |
| CVE-2024-58005 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: tpm: Change to kvalloc() in eventlog/acpi.c The following failure was reported … |
| CVE-2025-21653 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute syzbot found that TCA_F… |
| CVE-2025-21776 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: USB: hub: Ignore non-compliant devices with too many configs or interfaces Robe… |
| CVE-2025-21806 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: let net.core.dev_weight always be non-zero The following problem was encou… |
Named by the advisory itself. Each CVE links to its tracked detail page.
Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.