CVE-2025-39724

Vulnerability

Overview

CVE-2025-39724 is a race condition in the Linux kernel's 8250 serial driver that can lead to a kernel panic. The issue occurs when the PSLVERR_RESP_EN parameter is enabled, causing the device to generate an error response if an attempt is made to read an empty Receive Buffer Register (RBR) while the FIFO is enabled. During serial8250_do_startup(), a sequence of operations—writing to the Line Control Register (LCR), enabling the FIFO, and then reading the RBR—can trigger this condition. The race arises when another CPU is concurrently accessing the UART (e.g., via printk()), causing dw8250_check_lcr() to fail its check and enter dw8250_force_idle(), which ultimately leads to a panic [1][2].

Exploitation

Conditions

Exploitation requires the ability to trigger UART operations on a system where the affected driver is in use. The panic occurs during the startup sequence, so an attacker with local access or the ability to influence UART activity (e.g., through a malicious driver or user-space program) could potentially cause a denial of service. Siemens security advisories confirm that SIMATIC CN 4100 (all versions < V5.0) and SIMATIC S7-1500 CPU family (including related ET 200 CPUs and SIPLUS variants) are affected by this vulnerability [1][2].

Impact

The primary impact is a denial of service (system crash) due to the kernel panic. No privilege escalation or data leakage is described in the available sources. The panic backtrace shows the crash occurring in dw8250_serial_in32 during serial8250_do_startup() [1].

Mitigation

The fix has been applied in the Linux kernel stable tree via commits [3] and [4]. Siemens recommends updating affected products to the latest firmware versions that include the kernel patch [1][2]. Users of the Linux kernel should apply the corresponding stable updates to prevent the panic.