CVE-2025-68340
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: team: Move team device type change at the end of team_port_add Attempting to add a port device that is already up will expectedly fail, but not before modifying the team device header_ops. In the case of the syzbot reproducer the gre0 device is already in state UP when it attempts to add it as a port device of team0, this fails but before that header_ops->create of team0 is changed from eth_header to ipgre_header in the call to team_dev_type_check_change. Later when we end up in ipgre_header() struct ip_tunnel* points to nonsense as the private data of the device still holds a struct team. Example sequence of iproute2 commands to reproduce the hang/BUG(): ip link add dev team0 type team ip link add dev gre0 type gre ip link set dev gre0 up ip link set dev gre0 master team0 ip link set dev team0 up ping -I team0 1.1.1.1 Move team_dev_type_check_change down where all other checks have passed as it changes the dev type with no way to restore it in case one of the checks that follow it fail. Also make sure to preserve the origial mtu assignment: - If port_dev is not the same type as dev, dev takes mtu from port_dev - If port_dev is the same type as dev, port_dev takes mtu from dev This is done by adding a conditional before the call to dev_set_mtu to prevent it from assigning port_dev->mtu = dev->mtu and instead letting team_dev_type_check_change assign dev->mtu = port_dev->mtu. The conditional is needed because the patch moves the call to team_dev_type_check_change past dev_set_mtu. Testing: - team device driver in-tree selftests - Add/remove various devices as slaves of team device - syzbot
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-12-23 14:16:40.580000
Last modified
2026-10-19 21:10:00.160000
View original CVE JSON
{
"id": "CVE-2025-68340",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-12-23T14:16:40.580",
"lastModified": "2026-10-19T21:10:00.160",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nteam: Move team device type change at the end of team_port_add\n\nAttempting to add a port device that is already up will expectedly fail,\nbut not before modifying the team device header_ops.\n\nIn the case of the syzbot reproducer the gre0 device is\nalready in state UP when it attempts to add it as a\nport device of team0, this fails but before that\nheader_ops->create of team0 is changed from eth_header to ipgre_header\nin the call to team_dev_type_check_change.\n\nLater when we end up in ipgre_header() struct ip_tunnel* points to nonsense\nas the private data of the device still holds a struct team.\n\nExample sequence of iproute2 commands to reproduce the hang/BUG():\nip link add dev team0 type team\nip link add dev gre0 type gre\nip link set dev gre0 up\nip link set dev gre0 master team0\nip link set dev team0 up\nping -I team0 1.1.1.1\n\nMove team_dev_type_check_change down where all other checks have passed\nas it changes the dev type with no way to restore it in case\none of the checks that follow it fail.\n\nAlso make sure to preserve the origial mtu assignment:\n - If port_dev is not the same type as dev, dev takes mtu from port_dev\n - If port_dev is the same type as dev, port_dev takes mtu from dev\n\nThis is done by adding a conditional before the call to dev_set_mtu\nto prevent it from assigning port_dev->mtu = dev->mtu and instead\nletting team_dev_type_check_change assign dev->mtu = port_dev->mtu.\nThe conditional is needed because the patch moves the call to\nteam_dev_type_check_change past dev_set_mtu.\n\nTesting:\n - team device driver in-tree selftests\n - Add/remove various devices as slaves of team device\n - syzbot"
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha corregido la siguiente vulnerabilidad:\\n\\nteam: Move team device type change at the end of team_port_add\\n\\nIntentar añadir un dispositivo de puerto que ya está activo fallará como es de esperar,\\npero no antes de modificar los header_ops del dispositivo team.\\n\\nEn el caso del reproducidor de syzbot, el dispositivo gre0 está\\nya en estado UP cuando se intenta añadir como\\ndispositivo de puerto de team0; esto falla, pero antes de eso\\nheader_ops -> create de team0 se cambia de eth_header a ipgre_header\\nen la llamada a team_dev_type_check_change.\\n\\nMás tarde, cuando se llega a ipgre_header(), la estructura ip_tunnel apunta a datos sin sentido\\nya que los datos privados del dispositivo todavía contienen una estructura team.\\n\\nSecuencia de ejemplo de comandos iproute2 para reproducir el bloqueo/ERROR():\\nip link add dev team0 type team\\nip link add dev gre0 type gre\\nip link set dev gre0 up\\nip link set dev gre0 master team0\\nip link set dev team0 up\\nping -I team0 1.1.1.1\\n\\nMover team_dev_type_check_change hacia abajo, después de que se hayan pasado todas las demás comprobaciones,\\nya que cambia el tipo del dispositivo sin forma de restaurarlo en caso de que\\nalguna de las comprobaciones posteriores falle.\\n\\nTambién asegurarse de preservar la asignación original de MTU:\\n - Si port_dev no es del mismo tipo que dev, dev toma el MTU de port_dev\\n - Si port_dev es del mismo tipo que dev, port_dev toma el MTU de dev\\n\\nEsto se logra añadiendo una condición antes de la llamada a dev_set_mtu\\npara evitar que se asigne port_dev -> mtu = dev -> mtu y, en su lugar,\\npermitir que team_dev_type_check_change asigne dev -> mtu = port_dev -> mtu.\\nLa condición es necesaria porque el parche desplaza la llamada a\\nteam_dev_type_check_change más allá de dev_set_mtu.\\n\\nPruebas:\\n - pruebas de autoverificación del controlador de dispositivo team incluidas en el árbol\\n - Añadir/quitar varios dispositivos como esclavos del dispositivo team\\n - syzbot"
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/net/team/team_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a",
"lessThan": "f82d1fb65549de241fe312fcb2bcb8e0ad7b424d",
"versionType": "git",
"status": "affected"
},
{
"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a",
"lessThan": "c8b15b0d2eec3b5c7f585e5a53dfc8d36c818283",
"versionType": "git",
"status": "affected"
},
{
"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a",
"lessThan": "a74ab1b532ecc5f9106621a8f75b4c3d04466b35",
"versionType": "git",
"status": "affected"
},
{
"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a",
"lessThan": "e26235840fd961e4ebe5568f11a2a078cf726663",
"versionType": "git",
"status": "affected"
},
{
"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a",
"lessThan": "4040b5e8963982a00aa821300cb746efc9f2947e",
"versionType": "git",
"status": "affected"
},
{
"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a",
"lessThan": "e3eed4f038214494af62c7d2d64749e5108ce6ca",
"versionType": "git",
"status": "affected"
},
{
"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a",
"lessThan": "0ae9cfc454ea5ead5f3ddbdfe2e70270d8e2c8ef",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/net/team/team_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "3.7",
"status": "affected"
},
{
"version": "0",
"lessThan": "3.7",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.259",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.199",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.162",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.123",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.61",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17.11",
"lessThanOrEqual": "6.17.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-16T15:04:45.461983Z",
"id": "CVE-2025-68340",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.7",
"versionEndExcluding": "5.15.199",
"matchCriteriaId": "E5067FF3-398F-4DBC-A811-0FE8B82E8F38"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16",
"versionEndExcluding": "6.1.162",
"matchCriteriaId": "6579E0D4-0641-479D-A4C3-0EF618798C55"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2",
"versionEndExcluding": "6.6.123",
"matchCriteriaId": "316D8D4E-FE44-4C76-8403-63CAF51EEFC2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.61",
"matchCriteriaId": "6670FFDE-DE38-4ACA-9797-0E90908AC5D2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.17.11",
"matchCriteriaId": "D7C7E97D-F3F8-4E05-99B6-0650C54C6303"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD01661D-DFC8-4B6D-80E7-46D203CC4565"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A8A65C5A-918F-4E0B-8E98-08A29FFBA58A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc3:*:*:*:*:*:*",
"matchCriteriaId": "26CA425A-E44F-49D2-92D9-1DDD56398440"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc4:*:*:*:*:*:*",
"matchCriteriaId": "BEEBB43A-4C9F-46BE-AA6D-9DBFD2244E55"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc5:*:*:*:*:*:*",
"matchCriteriaId": "2545FB83-C4A6-4F62-9ED1-09F75D2E3C78"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc6:*:*:*:*:*:*",
"matchCriteriaId": "E955EC5D-4684-4B5D-AE4D-F2BF9ADDBA1D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc7:*:*:*:*:*:*",
"matchCriteriaId": "38C4D89F-9A13-4D29-8645-C9785C142C07"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/0ae9cfc454ea5ead5f3ddbdfe2e70270d8e2c8ef",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/4040b5e8963982a00aa821300cb746efc9f2947e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/a74ab1b532ecc5f9106621a8f75b4c3d04466b35",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/c8b15b0d2eec3b5c7f585e5a53dfc8d36c818283",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/e26235840fd961e4ebe5568f11a2a078cf726663",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/e3eed4f038214494af62c7d2d64749e5108ce6ca",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/f82d1fb65549de241fe312fcb2bcb8e0ad7b424d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}