Siemens patches Linux kernel flaw in SIMATIC/SIPLUS
A Linux kernel crypto vulnerability ('Copy Fail') affects numerous Siemens SIMATIC and SIPLUS HMI/runtime products; Siemens has released fixes for most, with others pending.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-31431 as exploited in the wild.
Siemens has disclosed CVE-2026-31431, dubbed 'Copy Fail,' a vulnerability in the Linux kernel's algif_aead crypto subsystem stemming from an in-place operation flaw (CWE-669: Incorrect Resource Transfer Between Spheres) that was later reverted upstream to restore out-of-place operation. The issue affects a broad swath of Siemens SIMATIC and SIPLUS products including SIMATIC AX Runtime Core Linux variants, numerous SIMATIC/SIPLUS HMI panels (MTP series), SIMATIC CN 4100, SIMATIC IoT2050 Advanced, SIMATIC IPC Industrial Edge Device OS, and SIMATIC S7-1500 TM MFP, deployed worldwide across critical manufacturing, energy, water/wastewater, chemical, food/agriculture, and commercial facilities sectors.
Siemens has released fixed versions (V21 Update 2 SR1 or later, or V6.0 for SIMATIC CN 4100) for most affected products, though fixes remain unavailable for some, including the SIMATIC AX Runtime Core Linux variants, SIMATIC IoT2050 Advanced, and SIMATIC IPC Industrial Edge Device OS. For products lacking a fix, Siemens recommends limiting access to the interactive shell of the additional GNU/Linux subsystem to trusted personnel and only running applications from trusted sources.
No evidence of active exploitation is mentioned in the advisory. CISA republished Siemens ProductCERT advisory SSA-328642 verbatim and recommends standard ICS hardening: minimizing network exposure of control system devices, isolating control networks behind firewalls, and using secure remote access methods such as VPNs where necessary.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-04
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs