Executive brief
A vulnerability in the Linux kernel's network 'teaming' driver could allow a local user to cause a system crash or deadlock. By attempting to add a network device to a team that is already indirectly part of that team (such as a physical interface and its virtual VLAN counterpart), the system can enter an infinite loop while trying to manage locks. This results in a denial-of-service condition where the system becomes unresponsive.
Technical details
A recursive locking vulnerability exists in the Linux kernel's ethernet teaming driver (drivers/net/team/team.c). The issue occurs when a user attempts to add a network device as a slave to a team interface when that device is already an 'upper' or 'lower' dependency of an existing team member (e.g., adding a physical veth device when its VLAN child is already a member). This configuration triggers a deadlock scenario because the `team_add_slave` function and the subsequent `team_device_event` notification both attempt to acquire the same `team->team_lock_key` mutex. An attacker with local privileges to configure network interfaces can exploit this to cause a kernel deadlock (Denial of Service). The fix introduces a check using `netdev_has_upper_dev` to prevent such circular or redundant attachments.
Affected products
- Linux Linux Kernel Fixed in 6.13.2, 6.12.13, 6.11.11, 6.6.76, 6.1.128, 5.15.178, 5.10.234, 5.4.290, 4.19.327
Timeline
- 2024-12-30: patched: Initial fix authored
- 2025-03-06: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/0a7794b9ca78c8e7d001c583bf05736169de3f20
- https://git.kernel.org/stable/c/184a564e6000b41582f160a5be9a9b5aabe22ac1
- https://git.kernel.org/stable/c/1bb06f919fa5bec77ad9b6002525c3dcc5c1fd6c
- https://git.kernel.org/stable/c/3fff5da4ca2164bb4d0f1e6cd33f6eb8a0e73e50
- https://git.kernel.org/stable/c/62ff1615815d565448c37cb8a7a2a076492ec471
- https://git.kernel.org/stable/c/adff6ac889e16d97abd1e4543f533221127e978a
- https://git.kernel.org/stable/c/bd099a2fa9be983ba0e90a57a59484fe9d520ba8