CVE-2026-31502

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31502", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.104Z", "datePublished": "2026-04-22T13:54:22.481Z", "dateUpdated": "2026-10-30T12:24:17.203Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:24:17.203Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nteam: fix header_ops type confusion with non-Ethernet ports\n\nSimilar to commit 950803f72547 (\"bonding: fix type confusion in\nbond_setup_by_slave()\") team has the same class of header_ops type\nconfusion.\n\nFor non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops\ndirectly. When the team device later calls dev_hard_header() or\ndev_parse_header(), these callbacks can run with the team net_device\ninstead of the real lower device, so netdev_priv(dev) is interpreted as\nthe wrong private type and can crash.\n\nThe syzbot report shows a crash in bond_header_create(), but the root\ncause is in team: the topology is gre -> bond -> team, and team calls\nthe inherited header_ops with its own net_device instead of the lower\ndevice, so bond_header_create() receives a team device and interprets\nnetdev_priv() as bonding private data, causing a type confusion crash.\n\nFix this by introducing team header_ops wrappers for create/parse,\nselecting a team port under RCU, and calling the lower device callbacks\nwith port->dev, so each callback always sees the correct net_device\ncontext.\n\nAlso pass the selected lower device to the lower parse callback, so\nrecursion is bounded in stacked non-Ethernet topologies and parse\ncallbacks always run with the correct device context."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - An attacker reaches the vulnerable team header_ops path by locally creating/enslaving network devices through rtnetlink and then triggering dev_hard_header()/dev_parse_header() via local packet/socket or network-stack activity on the malformed team device. The required setup is a local kernel networking configuration path rather than an unauthenticated packet-processing path.\nAC:L - The vulnerable topology, such as GRE -> bond -> team, is fully attacker-controlled once the required namespace capabilities are available, and triggering the bad callback is deterministic. There is no race or external timing condition required.\nPR:L - Creating team/bond/GRE devices and enslaving them requires CAP_NET_ADMIN, and packet sockets require CAP_NET_RAW, but both are available to an unprivileged user inside a user and network namespace on systems permitting unprivileged user namespaces. This is therefore low privileges, not real init-namespace root.\nUI:N - No victim interaction is required after the attacker has local access and namespace capabilities. The attacker can configure the devices and trigger the callback directly.\nS:U - The impact is within the same kernel security authority. This is a kernel crash/type-confusion or privilege-impact issue, not a VM escape or cross-scope boundary violation.\nC:H - The bug is a header_ops type confusion where callbacks interpret team private data as another subsystem's private structure, causing attacker-influenced kernel pointer dereferences and potential kernel memory exposure. Following the higher-severity rule for type confusion, confidentiality impact is high.\nI:H - Type confusion in kernel callback dispatch can lead to misinterpreted object pointers and potentially control-flow or write-primitive exploitation beyond the observed crash. Kernel type confusion is scored as high integrity impact.\nA:H - The reported and expected failure mode is a kernel oops/BUG/crash when the inherited callback uses the wrong net_device private layout. This gives high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/team/team_core.c"], "versions": [{"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "c6e255b0ce30cdea37e34d6d87e2212eb8c7f7a4", "status": "affected", "versionType": "git"}, {"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "420e5aad7ba89e8f79e2dc8327b0c0c24c1c1d53", "status": "affected", "versionType": "git"}, {"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "6d3161fa3eee64d46b766fb0db33ec7f300ef52d", "status": "affected", "versionType": "git"}, {"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "0a7468ed49a6b65d34abcc6eb60e15f7f6d34da0", "status": "affected", "versionType": "git"}, {"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "20491d384d973a63fbdaf7a71e38d69b0659ea55", "status": "affected", "versionType": "git"}, {"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "425000dbf17373a4ab8be9428f5dc055ef870a56", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/team/team_core.c"], "versions": [{"version": "3.7", "status": "affected"}, {"version": "0", "lessThan": "3.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.80", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.12.80"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c6e255b0ce30cdea37e34d6d87e2212eb8c7f7a4"}, {"url": "https://git.kernel.org/stable/c/420e5aad7ba89e8f79e2dc8327b0c0c24c1c1d53"}, {"url": "https://git.kernel.org/stable/c/6d3161fa3eee64d46b766fb0db33ec7f300ef52d"}, {"url": "https://git.kernel.org/stable/c/0a7468ed49a6b65d34abcc6eb60e15f7f6d34da0"}, {"url": "https://git.kernel.org/stable/c/20491d384d973a63fbdaf7a71e38d69b0659ea55"}, {"url": "https://git.kernel.org/stable/c/425000dbf17373a4ab8be9428f5dc055ef870a56"}], "title": "team: fix header_ops type confusion with non-Ethernet ports", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31502", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:10:14.938095Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-843", "description": "CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:45:53.793Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31502", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:10:14.938095Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-843", "description": "CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:10:15.583Z"}}], "cna": {"title": "team: fix header_ops type confusion with non-Ethernet ports", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - An attacker reaches the vulnerable team header_ops path by locally creating/enslaving network devices through rtnetlink and then triggering dev_hard_header()/dev_parse_header() via local packet/socket or network-stack activity on the malformed team device. The required setup is a local kernel networking configuration path rather than an unauthenticated packet-processing path.\nAC:L - The vulnerable topology, such as GRE -> bond -> team, is fully attacker-controlled once the required namespace capabilities are available, and triggering the bad callback is deterministic. There is no race or external timing condition required.\nPR:L - Creating team/bond/GRE devices and enslaving them requires CAP_NET_ADMIN, and packet sockets require CAP_NET_RAW, but both are available to an unprivileged user inside a user and network namespace on systems permitting unprivileged user namespaces. This is therefore low privileges, not real init-namespace root.\nUI:N - No victim interaction is required after the attacker has local access and namespace capabilities. The attacker can configure the devices and trigger the callback directly.\nS:U - The impact is within the same kernel security authority. This is a kernel crash/type-confusion or privilege-impact issue, not a VM escape or cross-scope boundary violation.\nC:H - The bug is a header_ops type confusion where callbacks interpret team private data as another subsystem's private structure, causing attacker-influenced kernel pointer dereferences and potential kernel memory exposure. Following the higher-severity rule for type confusion, confidentiality impact is high.\nI:H - Type confusion in kernel callback dispatch can lead to misinterpreted object pointers and potentially control-flow or write-primitive exploitation beyond the observed crash. Kernel type confusion is scored as high integrity impact.\nA:H - The reported and expected failure mode is a kernel oops/BUG/crash when the inherited callback uses the wrong net_device private layout. This gives high availability impact."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "c6e255b0ce30cdea37e34d6d87e2212eb8c7f7a4", "versionType": "git"}, {"status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "420e5aad7ba89e8f79e2dc8327b0c0c24c1c1d53", "versionType": "git"}, {"status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "6d3161fa3eee64d46b766fb0db33ec7f300ef52d", "versionType": "git"}, {"status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "0a7468ed49a6b65d34abcc6eb60e15f7f6d34da0", "versionType": "git"}, {"status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "20491d384d973a63fbdaf7a71e38d69b0659ea55", "versionType": "git"}, {"status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "lessThan": "425000dbf17373a4ab8be9428f5dc055ef870a56", "versionType": "git"}], "programFiles": ["drivers/net/team/team_core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.7"}, {"status": "unaffected", "version": "0", "lessThan": "3.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.80", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.21", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.11", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/team/team_core.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/c6e255b0ce30cdea37e34d6d87e2212eb8c7f7a4"}, {"url": "https://git.kernel.org/stable/c/420e5aad7ba89e8f79e2dc8327b0c0c24c1c1d53"}, {"url": "https://git.kernel.org/stable/c/6d3161fa3eee64d46b766fb0db33ec7f300ef52d"}, {"url": "https://git.kernel.org/stable/c/0a7468ed49a6b65d34abcc6eb60e15f7f6d34da0"}, {"url": "https://git.kernel.org/stable/c/20491d384d973a63fbdaf7a71e38d69b0659ea55"}, {"url": "https://git.kernel.org/stable/c/425000dbf17373a4ab8be9428f5dc055ef870a56"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nteam: fix header_ops type confusion with non-Ethernet ports\n\nSimilar to commit 950803f72547 (\"bonding: fix type confusion in\nbond_setup_by_slave()\") team has the same class of header_ops type\nconfusion.\n\nFor non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops\ndirectly. When the team device later calls dev_hard_header() or\ndev_parse_header(), these callbacks can run with the team net_device\ninstead of the real lower device, so netdev_priv(dev) is interpreted as\nthe wrong private type and can crash.\n\nThe syzbot report shows a crash in bond_header_create(), but the root\ncause is in team: the topology is gre -> bond -> team, and team calls\nthe inherited header_ops with its own net_device instead of the lower\ndevice, so bond_header_create() receives a team device and interprets\nnetdev_priv() as bonding private data, causing a type confusion crash.\n\nFix this by introducing team header_ops wrappers for create/parse,\nselecting a team port under RCU, and calling the lower device callbacks\nwith port->dev, so each callback always sees the correct net_device\ncontext.\n\nAlso pass the selected lower device to the lower parse callback, so\nrecursion is bounded in stacked non-Ethernet topologies and parse\ncallbacks always run with the correct device context."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.145", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.80", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.21", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.11", "versionStartIncluding": "3.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "3.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:24:17.203Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31502", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:24:17.203Z", "dateReserved": "2026-03-09T15:48:24.104Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-22T13:54:22.481Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/team/team_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c6e255b0ce30cdea37e34d6d87e2212eb8c7f7a4", "status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "versionType": "git"}, {"lessThan": "420e5aad7ba89e8f79e2dc8327b0c0c24c1c1d53", "status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "versionType": "git"}, {"lessThan": "6d3161fa3eee64d46b766fb0db33ec7f300ef52d", "status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "versionType": "git"}, {"lessThan": "0a7468ed49a6b65d34abcc6eb60e15f7f6d34da0", "status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "versionType": "git"}, {"lessThan": "20491d384d973a63fbdaf7a71e38d69b0659ea55", "status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "versionType": "git"}, {"lessThan": "425000dbf17373a4ab8be9428f5dc055ef870a56", "status": "affected", "version": "1d76efe1577b4323609b1bcbfafa8b731eda071a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/team/team_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.7"}, {"lessThan": "3.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.80", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.21", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D205AD2D-8373-44D8-BB6D-74C87BD8E73A", "versionEndExcluding": "6.12.80", "versionStartIncluding": "3.7.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED39847A-3B46-4729-B7CA-B2C30B9FA8FE", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:3.7:-:*:*:*:*:*:*", "matchCriteriaId": "F482CC77-4452-423A-8A57-523E1AEA1087", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nteam: fix header_ops type confusion with non-Ethernet ports\n\nSimilar to commit 950803f72547 (\"bonding: fix type confusion in\nbond_setup_by_slave()\") team has the same class of header_ops type\nconfusion.\n\nFor non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops\ndirectly. When the team device later calls dev_hard_header() or\ndev_parse_header(), these callbacks can run with the team net_device\ninstead of the real lower device, so netdev_priv(dev) is interpreted as\nthe wrong private type and can crash.\n\nThe syzbot report shows a crash in bond_header_create(), but the root\ncause is in team: the topology is gre -> bond -> team, and team calls\nthe inherited header_ops with its own net_device instead of the lower\ndevice, so bond_header_create() receives a team device and interprets\nnetdev_priv() as bonding private data, causing a type confusion crash.\n\nFix this by introducing team header_ops wrappers for create/parse,\nselecting a team port under RCU, and calling the lower device callbacks\nwith port->dev, so each callback always sees the correct net_device\ncontext.\n\nAlso pass the selected lower device to the lower parse callback, so\nrecursion is bounded in stacked non-Ethernet topologies and parse\ncallbacks always run with the correct device context."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nteam: corrige la confusi\u00f3n de tipo de header_ops con puertos que no son Ethernet\n\nSimilar al commit 950803f72547 (\u2019bonding: corrige la confusi\u00f3n de tipo en bond_setup_by_slave()\u2019), team tiene la misma clase de confusi\u00f3n de tipo de header_ops.\n\nPara puertos que no son Ethernet, team_setup_by_port() copia port_dev -> header_ops directamente. Cuando el dispositivo team llama m\u00e1s tarde a dev_hard_header() o dev_parse_header(), estas devoluciones de llamada pueden ejecutarse con el net_device del team en lugar del dispositivo inferior real, por lo que netdev_priv(dev) se interpreta como el tipo privado incorrecto y puede causar un fallo.\n\nEl informe de syzbot muestra un fallo en bond_header_create(), pero la causa ra\u00edz est\u00e1 en team: la topolog\u00eda es gre -> bond -> team, y team llama a los header_ops heredados con su propio net_device en lugar del dispositivo inferior, por lo que bond_header_create() recibe un dispositivo team e interpreta netdev_priv() como datos privados de bonding, causando un fallo por confusi\u00f3n de tipo.\n\nSoluciona esto introduciendo envoltorios de header_ops de team para create/parse, seleccionando un puerto de team bajo RCU, y llamando a las devoluciones de llamada del dispositivo inferior con port -> dev, para que cada devoluci\u00f3n de llamada siempre vea el contexto net_device correcto.\n\nTambi\u00e9n pasa el dispositivo inferior seleccionado a la devoluci\u00f3n de llamada de an\u00e1lisis inferior, para que la recursi\u00f3n est\u00e9 limitada en topolog\u00edas apiladas que no son Ethernet y las devoluciones de llamada de an\u00e1lisis siempre se ejecuten con el contexto de dispositivo correcto."}], "id": "CVE-2026-31502", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31502", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:10:14.938095Z", "version": "2.0.3"}}]}, "published": "2026-04-22T14:16:48.713", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0a7468ed49a6b65d34abcc6eb60e15f7f6d34da0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/20491d384d973a63fbdaf7a71e38d69b0659ea55"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/420e5aad7ba89e8f79e2dc8327b0c0c24c1c1d53"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/425000dbf17373a4ab8be9428f5dc055ef870a56"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6d3161fa3eee64d46b766fb0db33ec7f300ef52d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c6e255b0ce30cdea37e34d6d87e2212eb8c7f7a4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-843"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-843"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: team: fix header_ops type confusion with non-Ethernet ports", "id": "2460684", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460684"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-843", "details": ["A flaw was found in the Linux kernel's team network device. This vulnerability involves a type confusion in header operations when handling non-Ethernet ports. An attacker could potentially exploit this by causing the team device to misinterpret network device private data, leading to a system crash and a Denial of Service (DoS)."], "name": "CVE-2026-31502", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31502\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31502\nhttps://lore.kernel.org/linux-cve-announce/2026042205-CVE-2026-31502-4b98@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1d76efe1577b4323609b1bcbfafa8b731eda071a,6d3161fa3eee64d46b766fb0db33ec7f300ef52d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1d76efe1577b4323609b1bcbfafa8b731eda071a,0a7468ed49a6b65d34abcc6eb60e15f7f6d34da0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1d76efe1577b4323609b1bcbfafa8b731eda071a,20491d384d973a63fbdaf7a71e38d69b0659ea55)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1d76efe1577b4323609b1bcbfafa8b731eda071a,425000dbf17373a4ab8be9428f5dc055ef870a56)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.80,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.21,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.11,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T20:50:53.122217+00:00", "value": {"mitigation_remediation": ["Upgrade the Linux kernel to a version that includes the commit introducing team header_ops wrappers for create and parse callbacks.", "Ensure that the system is not running older kernels that were compiled before the fix was applied.", "If the team networking functionality is unnecessary, disable or remove team network devices to eliminate the attack surface."], "summary": {"action": "Apply Patch", "impact": "Kernel crash (Denial of Service)"}, "threat_synthesis": {"affected_systems": "All Linux kernel implementations that include the team networking framework are affected; no specific kernel version range is listed, so any kernel before the commit that introduced the fix is potentially vulnerable.", "description_and_impact": "The vulnerability in the Linux kernel is a type confusion flaw that occurs when a team network device, configured on a non\u2011Ethernet port, copies the port\u2019s header_ops directly. When the team device later calls dev_hard_header or dev_parse_header, the wrong private data is interpreted as belonging to the team device, leading to a kernel crash. The crash is triggered by a misguided call to the bonding stack where the lower device\u2019s header_ops receives a team device context, causing an incorrect netdev_priv interpretation and a type confusion fault.", "risk_and_exploitability": "The EPSS score is < 1%, and the vulnerability is not listed in CISA\u2019s KEV catalog, indicating limited publicly known exploitation. Based on the description, it is inferred that an attacker could trigger the bug by sending crafted network traffic to a team device configured on a non\u2011Ethernet port, potentially allowing a remote attacker to induce a kernel panic and disrupt service. The CVSS score of 7.8 reflects the high\u2011severity potential for denial of service due to a kernel crash."}}}}, "created": "2026-04-22T17:45:22.659850+00:00", "updated": "2026-04-28T21:00:14.750779+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}