CVE-2025-68340

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68340", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-16T14:48:05.297Z", "datePublished": "2025-12-23T13:58:25.841Z", "dateUpdated": "2026-10-16T15:09:43.166Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:10:56.438Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nteam: Move team device type change at the end of team_port_add\n\nAttempting to add a port device that is already up will expectedly fail,\nbut not before modifying the team device header_ops.\n\nIn the case of the syzbot reproducer the gre0 device is\nalready in state UP when it attempts to add it as a\nport device of team0, this fails but before that\nheader_ops->create of team0 is changed from eth_header to ipgre_header\nin the call to team_dev_type_check_change.\n\nLater when we end up in ipgre_header() struct ip_tunnel* points to nonsense\nas the private data of the device still holds a struct team.\n\nExample sequence of iproute2 commands to reproduce the hang/BUG():\nip link add dev team0 type team\nip link add dev gre0 type gre\nip link set dev gre0 up\nip link set dev gre0 master team0\nip link set dev team0 up\nping -I team0 1.1.1.1\n\nMove team_dev_type_check_change down where all other checks have passed\nas it changes the dev type with no way to restore it in case\none of the checks that follow it fail.\n\nAlso make sure to preserve the origial mtu assignment:\n - If port_dev is not the same type as dev, dev takes mtu from port_dev\n - If port_dev is the same type as dev, port_dev takes mtu from dev\n\nThis is done by adding a conditional before the call to dev_set_mtu\nto prevent it from assigning port_dev->mtu = dev->mtu and instead\nletting team_dev_type_check_change assign dev->mtu = port_dev->mtu.\nThe conditional is needed because the patch moves the call to\nteam_dev_type_check_change past dev_set_mtu.\n\nTesting:\n - team device driver in-tree selftests\n - Add/remove various devices as slaves of team device\n - syzbot"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through a local NETLINK_ROUTE RTM_NEWLINK request containing IFLA_MASTER. Network traffic only activates the already-corrupted callback and is not the initial attack vector.\nAC:L - A deterministic sequence of interface operations leaves the team device with stale header operations; no race or attacker-independent condition is required.\nPR:L - RTNL requires CAP_NET_ADMIN in the network namespace owning the socket, which an unprivileged local user can obtain through user and network namespaces where enabled.\nUI:N - The attacker performs all required interface operations, and opening the corrupted team device can itself schedule IPv6 MLD traffic that reaches the invalid callback.\nS:U - The vulnerable team driver and the affected kernel resources share the same security authority; ordinary kernel compromise does not constitute a scope change.\nC:H - The attacker-selected callback interprets team-private kernel memory and pointers as an unrelated tunnel structure. Applying the required conservative treatment for kernel type confusion, potential kernel-memory disclosure is High.\nI:H - The mismatched callback operates on packet buffers and dereferences private fields using the wrong structure layout. Under the required type-confusion guidance, potential memory corruption or control-flow abuse warrants High integrity impact.\nA:H - The demonstrated path supplies a nonsensical header length to skb_push(), causing skb_under_panic and BUG(), and can therefore crash or hang the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/team/team_core.c"], "versions": [{"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "f82d1fb65549de241fe312fcb2bcb8e0ad7b424d", "status": "affected", "versionType": "git"}, {"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "c8b15b0d2eec3b5c7f585e5a53dfc8d36c818283", "status": "affected", "versionType": "git"}, {"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "a74ab1b532ecc5f9106621a8f75b4c3d04466b35", "status": "affected", "versionType": "git"}, {"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "e26235840fd961e4ebe5568f11a2a078cf726663", "status": "affected", "versionType": "git"}, {"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "4040b5e8963982a00aa821300cb746efc9f2947e", "status": "affected", "versionType": "git"}, {"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "e3eed4f038214494af62c7d2d64749e5108ce6ca", "status": "affected", "versionType": "git"}, {"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "0ae9cfc454ea5ead5f3ddbdfe2e70270d8e2c8ef", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/team/team_core.c"], "versions": [{"version": "3.7", "status": "affected"}, {"version": "0", "lessThan": "3.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.199", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.162", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.123", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.61", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.11", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.10.259"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.15.199"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.1.162"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.6.123"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.12.61"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.17.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f82d1fb65549de241fe312fcb2bcb8e0ad7b424d"}, {"url": "https://git.kernel.org/stable/c/c8b15b0d2eec3b5c7f585e5a53dfc8d36c818283"}, {"url": "https://git.kernel.org/stable/c/a74ab1b532ecc5f9106621a8f75b4c3d04466b35"}, {"url": "https://git.kernel.org/stable/c/e26235840fd961e4ebe5568f11a2a078cf726663"}, {"url": "https://git.kernel.org/stable/c/4040b5e8963982a00aa821300cb746efc9f2947e"}, {"url": "https://git.kernel.org/stable/c/e3eed4f038214494af62c7d2d64749e5108ce6ca"}, {"url": "https://git.kernel.org/stable/c/0ae9cfc454ea5ead5f3ddbdfe2e70270d8e2c8ef"}], "title": "team: Move team device type change at the end of team_port_add", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68340", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:04:45.461983Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:09:43.166Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68340", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:04:45.461983Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:04:46.235Z"}}], "cna": {"title": "team: Move team device type change at the end of team_port_add", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through a local NETLINK_ROUTE RTM_NEWLINK request containing IFLA_MASTER. Network traffic only activates the already-corrupted callback and is not the initial attack vector.\nAC:L - A deterministic sequence of interface operations leaves the team device with stale header operations; no race or attacker-independent condition is required.\nPR:L - RTNL requires CAP_NET_ADMIN in the network namespace owning the socket, which an unprivileged local user can obtain through user and network namespaces where enabled.\nUI:N - The attacker performs all required interface operations, and opening the corrupted team device can itself schedule IPv6 MLD traffic that reaches the invalid callback.\nS:U - The vulnerable team driver and the affected kernel resources share the same security authority; ordinary kernel compromise does not constitute a scope change.\nC:H - The attacker-selected callback interprets team-private kernel memory and pointers as an unrelated tunnel structure. Applying the required conservative treatment for kernel type confusion, potential kernel-memory disclosure is High.\nI:H - The mismatched callback operates on packet buffers and dereferences private fields using the wrong structure layout. Under the required type-confusion guidance, potential memory corruption or control-flow abuse warrants High integrity impact.\nA:H - The demonstrated path supplies a nonsensical header length to skb_push(), causing skb_under_panic and BUG(), and can therefore crash or hang the kernel."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "f82d1fb65549de241fe312fcb2bcb8e0ad7b424d", "versionType": "git"}, {"status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "c8b15b0d2eec3b5c7f585e5a53dfc8d36c818283", "versionType": "git"}, {"status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "a74ab1b532ecc5f9106621a8f75b4c3d04466b35", "versionType": "git"}, {"status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "e26235840fd961e4ebe5568f11a2a078cf726663", "versionType": "git"}, {"status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "4040b5e8963982a00aa821300cb746efc9f2947e", "versionType": "git"}, {"status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "e3eed4f038214494af62c7d2d64749e5108ce6ca", "versionType": "git"}, {"status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "0ae9cfc454ea5ead5f3ddbdfe2e70270d8e2c8ef", "versionType": "git"}], "programFiles": ["drivers/net/team/team_core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.7"}, {"status": "unaffected", "version": "0", "lessThan": "3.7", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.259", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.199", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.162", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.123", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.61", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.11", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/team/team_core.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/f82d1fb65549de241fe312fcb2bcb8e0ad7b424d"}, {"url": "https://git.kernel.org/stable/c/c8b15b0d2eec3b5c7f585e5a53dfc8d36c818283"}, {"url": "https://git.kernel.org/stable/c/a74ab1b532ecc5f9106621a8f75b4c3d04466b35"}, {"url": "https://git.kernel.org/stable/c/e26235840fd961e4ebe5568f11a2a078cf726663"}, {"url": "https://git.kernel.org/stable/c/4040b5e8963982a00aa821300cb746efc9f2947e"}, {"url": "https://git.kernel.org/stable/c/e3eed4f038214494af62c7d2d64749e5108ce6ca"}, {"url": "https://git.kernel.org/stable/c/0ae9cfc454ea5ead5f3ddbdfe2e70270d8e2c8ef"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nteam: Move team device type change at the end of team_port_add\n\nAttempting to add a port device that is already up will expectedly fail,\nbut not before modifying the team device header_ops.\n\nIn the case of the syzbot reproducer the gre0 device is\nalready in state UP when it attempts to add it as a\nport device of team0, this fails but before that\nheader_ops->create of team0 is changed from eth_header to ipgre_header\nin the call to team_dev_type_check_change.\n\nLater when we end up in ipgre_header() struct ip_tunnel* points to nonsense\nas the private data of the device still holds a struct team.\n\nExample sequence of iproute2 commands to reproduce the hang/BUG():\nip link add dev team0 type team\nip link add dev gre0 type gre\nip link set dev gre0 up\nip link set dev gre0 master team0\nip link set dev team0 up\nping -I team0 1.1.1.1\n\nMove team_dev_type_check_change down where all other checks have passed\nas it changes the dev type with no way to restore it in case\none of the checks that follow it fail.\n\nAlso make sure to preserve the origial mtu assignment:\n - If port_dev is not the same type as dev, dev takes mtu from port_dev\n - If port_dev is the same type as dev, port_dev takes mtu from dev\n\nThis is done by adding a conditional before the call to dev_set_mtu\nto prevent it from assigning port_dev->mtu = dev->mtu and instead\nletting team_dev_type_check_change assign dev->mtu = port_dev->mtu.\nThe conditional is needed because the patch moves the call to\nteam_dev_type_check_change past dev_set_mtu.\n\nTesting:\n - team device driver in-tree selftests\n - Add/remove various devices as slaves of team device\n - syzbot"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.259", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.199", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.162", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.123", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.61", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.11", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "3.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:10:56.438Z"}}}, "cveMetadata": {"cveId": "CVE-2025-68340", "state": "PUBLISHED", "dateUpdated": "2026-10-16T15:09:43.166Z", "dateReserved": "2025-12-16T14:48:05.297Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-12-23T13:58:25.841Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/team/team_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f82d1fb65549de241fe312fcb2bcb8e0ad7b424d", "status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "versionType": "git"}, {"lessThan": "c8b15b0d2eec3b5c7f585e5a53dfc8d36c818283", "status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "versionType": "git"}, {"lessThan": "a74ab1b532ecc5f9106621a8f75b4c3d04466b35", "status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "versionType": "git"}, {"lessThan": "e26235840fd961e4ebe5568f11a2a078cf726663", "status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "versionType": "git"}, {"lessThan": "4040b5e8963982a00aa821300cb746efc9f2947e", "status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "versionType": "git"}, {"lessThan": "e3eed4f038214494af62c7d2d64749e5108ce6ca", "status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "versionType": "git"}, {"lessThan": "0ae9cfc454ea5ead5f3ddbdfe2e70270d8e2c8ef", "status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/team/team_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.7"}, {"lessThan": "3.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.259", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.199", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.162", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.123", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.61", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E5067FF3-398F-4DBC-A811-0FE8B82E8F38", "versionEndExcluding": "5.15.199", "versionStartIncluding": "3.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6579E0D4-0641-479D-A4C3-0EF618798C55", "versionEndExcluding": "6.1.162", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "316D8D4E-FE44-4C76-8403-63CAF51EEFC2", "versionEndExcluding": "6.6.123", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6670FFDE-DE38-4ACA-9797-0E90908AC5D2", "versionEndExcluding": "6.12.61", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D7C7E97D-F3F8-4E05-99B6-0650C54C6303", "versionEndExcluding": "6.17.11", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc1:*:*:*:*:*:*", "matchCriteriaId": "DD01661D-DFC8-4B6D-80E7-46D203CC4565", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc2:*:*:*:*:*:*", "matchCriteriaId": "A8A65C5A-918F-4E0B-8E98-08A29FFBA58A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc3:*:*:*:*:*:*", "matchCriteriaId": "26CA425A-E44F-49D2-92D9-1DDD56398440", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc4:*:*:*:*:*:*", "matchCriteriaId": "BEEBB43A-4C9F-46BE-AA6D-9DBFD2244E55", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc5:*:*:*:*:*:*", "matchCriteriaId": "2545FB83-C4A6-4F62-9ED1-09F75D2E3C78", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc6:*:*:*:*:*:*", "matchCriteriaId": "E955EC5D-4684-4B5D-AE4D-F2BF9ADDBA1D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc7:*:*:*:*:*:*", "matchCriteriaId": "38C4D89F-9A13-4D29-8645-C9785C142C07", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nteam: Move team device type change at the end of team_port_add\n\nAttempting to add a port device that is already up will expectedly fail,\nbut not before modifying the team device header_ops.\n\nIn the case of the syzbot reproducer the gre0 device is\nalready in state UP when it attempts to add it as a\nport device of team0, this fails but before that\nheader_ops->create of team0 is changed from eth_header to ipgre_header\nin the call to team_dev_type_check_change.\n\nLater when we end up in ipgre_header() struct ip_tunnel* points to nonsense\nas the private data of the device still holds a struct team.\n\nExample sequence of iproute2 commands to reproduce the hang/BUG():\nip link add dev team0 type team\nip link add dev gre0 type gre\nip link set dev gre0 up\nip link set dev gre0 master team0\nip link set dev team0 up\nping -I team0 1.1.1.1\n\nMove team_dev_type_check_change down where all other checks have passed\nas it changes the dev type with no way to restore it in case\none of the checks that follow it fail.\n\nAlso make sure to preserve the origial mtu assignment:\n - If port_dev is not the same type as dev, dev takes mtu from port_dev\n - If port_dev is the same type as dev, port_dev takes mtu from dev\n\nThis is done by adding a conditional before the call to dev_set_mtu\nto prevent it from assigning port_dev->mtu = dev->mtu and instead\nletting team_dev_type_check_change assign dev->mtu = port_dev->mtu.\nThe conditional is needed because the patch moves the call to\nteam_dev_type_check_change past dev_set_mtu.\n\nTesting:\n - team device driver in-tree selftests\n - Add/remove various devices as slaves of team device\n - syzbot"}, {"lang": "es", "value": "En el kernel de Linux, se ha corregido la siguiente vulnerabilidad:\\n\\nteam: Move team device type change at the end of team_port_add\\n\\nIntentar a\u00f1adir un dispositivo de puerto que ya est\u00e1 activo fallar\u00e1 como es de esperar,\\npero no antes de modificar los header_ops del dispositivo team.\\n\\nEn el caso del reproducidor de syzbot, el dispositivo gre0 est\u00e1\\nya en estado UP cuando se intenta a\u00f1adir como\\ndispositivo de puerto de team0; esto falla, pero antes de eso\\nheader_ops -> create de team0 se cambia de eth_header a ipgre_header\\nen la llamada a team_dev_type_check_change.\\n\\nM\u00e1s tarde, cuando se llega a ipgre_header(), la estructura ip_tunnel apunta a datos sin sentido\\nya que los datos privados del dispositivo todav\u00eda contienen una estructura team.\\n\\nSecuencia de ejemplo de comandos iproute2 para reproducir el bloqueo/ERROR():\\nip link add dev team0 type team\\nip link add dev gre0 type gre\\nip link set dev gre0 up\\nip link set dev gre0 master team0\\nip link set dev team0 up\\nping -I team0 1.1.1.1\\n\\nMover team_dev_type_check_change hacia abajo, despu\u00e9s de que se hayan pasado todas las dem\u00e1s comprobaciones,\\nya que cambia el tipo del dispositivo sin forma de restaurarlo en caso de que\\nalguna de las comprobaciones posteriores falle.\\n\\nTambi\u00e9n asegurarse de preservar la asignaci\u00f3n original de MTU:\\n - Si port_dev no es del mismo tipo que dev, dev toma el MTU de port_dev\\n - Si port_dev es del mismo tipo que dev, port_dev toma el MTU de dev\\n\\nEsto se logra a\u00f1adiendo una condici\u00f3n antes de la llamada a dev_set_mtu\\npara evitar que se asigne port_dev -> mtu = dev -> mtu y, en su lugar,\\npermitir que team_dev_type_check_change asigne dev -> mtu = port_dev -> mtu.\\nLa condici\u00f3n es necesaria porque el parche desplaza la llamada a\\nteam_dev_type_check_change m\u00e1s all\u00e1 de dev_set_mtu.\\n\\nPruebas:\\n - pruebas de autoverificaci\u00f3n del controlador de dispositivo team incluidas en el \u00e1rbol\\n - A\u00f1adir/quitar varios dispositivos como esclavos del dispositivo team\\n - syzbot"}], "id": "CVE-2025-68340", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68340", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:04:45.461983Z", "version": "2.0.3"}}]}, "published": "2025-12-23T14:16:40.580", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0ae9cfc454ea5ead5f3ddbdfe2e70270d8e2c8ef"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4040b5e8963982a00aa821300cb746efc9f2947e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a74ab1b532ecc5f9106621a8f75b4c3d04466b35"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c8b15b0d2eec3b5c7f585e5a53dfc8d36c818283"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e26235840fd961e4ebe5568f11a2a078cf726663"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e3eed4f038214494af62c7d2d64749e5108ce6ca"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f82d1fb65549de241fe312fcb2bcb8e0ad7b424d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: team: Move team device type change at the end of team_port_add", "id": "2424608", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2424608"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-68340", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-68340\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68340\nhttps://lore.kernel.org/linux-cve-announce/2025122332-CVE-2025-68340-1611@gregkh/T"], "threat_severity": "Moderate"}

{}