Executive brief
A vulnerability in the Linux kernel's network 'team' device driver could allow a local user to crash the system. The issue occurs when attempting to add a network interface that is already active to a team group, which causes the system to incorrectly handle internal data structures. This can lead to a system hang or a kernel panic, impacting the availability of the server.
Technical details
A logic error in the team driver's team_port_add function allows team_dev_type_check_change to modify a team device's header_ops (e.g., changing eth_header to ipgre_header) even if the subsequent port addition fails because the port is already in an UP state. When the kernel later attempts to use these modified header_ops, it treats the team device's private data as a different structure type (e.g., struct ip_tunnel), leading to memory corruption and a kernel BUG() or system hang. The fix moves the device type change to the end of the function after all validation checks have passed. This is reachable by a local user with sufficient privileges to manage network interfaces.
Affected products
- Linux Linux Kernel 3.7 to 5.15.199, 6.1.162, 6.6.123, 6.12.61
Timeline
- 2025-11-22: disclosed: Initial patch submission
- 2025-12-23: advisory: CVE-2025-68340 published
References
- https://git.kernel.org/stable/c/0ae9cfc454ea5ead5f3ddbdfe2e70270d8e2c8ef
- https://git.kernel.org/stable/c/4040b5e8963982a00aa821300cb746efc9f2947e
- https://git.kernel.org/stable/c/a74ab1b532ecc5f9106621a8f75b4c3d04466b35
- https://git.kernel.org/stable/c/c8b15b0d2eec3b5c7f585e5a53dfc8d36c818283
- https://git.kernel.org/stable/c/e26235840fd961e4ebe5568f11a2a078cf726663
- https://git.kernel.org/stable/c/e3eed4f038214494af62c7d2d64749e5108ce6ca
- https://git.kernel.org/stable/c/f82d1fb65549de241fe312fcb2bcb8e0ad7b424d