Executive brief
The Linux kernel has a stack overflow vulnerability in its network interface handling when disabling LRO (Large Receive Offload) on virtual interfaces like team or bonding devices. When updating LRO settings on a parent virtual interface with many child interfaces (e.g., 200 team members), the feature synchronization logic inadvertently triggers recursive notifications instead of iterating sequentially, causing the call stack to overflow and crash the system. This can lead to denial of service and potential system instability.
Technical details
The vulnerability is a stack overflow in the netdev notification mechanism within net/core/dev.c and related network stack code. The root cause is that netdev_sync_lower_features() generates NETDEV_FEAT_CHANGE notifications for lower interfaces, which also propagate to upper (parent) interfaces. This causes the parent to re-notify lower interfaces, creating a cascade of recursive calls rather than iteration. The attack vector requires local network configuration access (e.g., via ethtool commands to modify LRO settings on virtual interfaces). The precondition is having a multi-level virtual interface hierarchy (team or bonding with many member interfaces). An attacker with capability to modify network interface settings can trigger a kernel stack overflow, leading to denial of service. A fix has been implemented by introducing a notifier_ctx member to track notification state in bonding/team drivers.
Affected products
- Linux Linux kernel Affected versions prior to the fix
Timeline
- 2025-12-24: disclosed
- patched: Fix introduced via notifier_ctx member in bonding/team drivers