Siemens patches Linux kernel flaw in SIMATIC/SIPLUS

A Linux kernel crypto vulnerability ('Copy Fail') affects numerous Siemens SIMATIC and SIPLUS HMI/runtime products; Siemens has released fixes for most, with others pending.

Siemens has disclosed CVE-2026-31431, dubbed 'Copy Fail,' a vulnerability in the Linux kernel's algif_aead crypto subsystem stemming from an in-place operation flaw (CWE-669: Incorrect Resource Transfer Between Spheres) that was later reverted upstream to restore out-of-place operation. The issue affects a broad swath of Siemens SIMATIC and SIPLUS products including SIMATIC AX Runtime Core Linux variants, numerous SIMATIC/SIPLUS HMI panels (MTP series), SIMATIC CN 4100, SIMATIC IoT2050 Advanced, SIMATIC IPC Industrial Edge Device OS, and SIMATIC S7-1500 TM MFP, deployed worldwide across critical manufacturing, energy, water/wastewater, chemical, food/agriculture, and commercial facilities sectors.

Siemens has released fixed versions (V21 Update 2 SR1 or later, or V6.0 for SIMATIC CN 4100) for most affected products, though fixes remain unavailable for some, including the SIMATIC AX Runtime Core Linux variants, SIMATIC IoT2050 Advanced, and SIMATIC IPC Industrial Edge Device OS. For products lacking a fix, Siemens recommends limiting access to the interactive shell of the additional GNU/Linux subsystem to trusted personnel and only running applications from trusted sources.

No evidence of active exploitation is mentioned in the advisory. CISA republished Siemens ProductCERT advisory SSA-328642 verbatim and recommends standard ICS hardening: minimizing network exposure of control system devices, isolating control networks behind firewalls, and using secure remote access methods such as VPNs where necessary.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-04