CVE-2025-71091: Linux Kernel Privilege Escalation Flaw

CVE-2025-71091 Overview

A race condition vulnerability exists in the Linux kernel's team network driver that can lead to list corruption and a kernel panic. The flaw is located in the team_queue_override_port_prio_changed() function within drivers/net/team/team_core.c, where an improper check for port enabled state allows a double-free condition on a linked list entry. This vulnerability was discovered through syzkaller fuzzing and affects systems using the team network driver for link aggregation.

Critical Impact

Exploitation of this vulnerability can cause a kernel BUG (panic) resulting in complete system denial of service, requiring a hard reboot to recover.

Affected Products

• Linux kernel with team network driver enabled
• Systems using link aggregation via the team driver
• Affected kernel versions prior to the security patches

Discovery Timeline

• 2026-01-13 - CVE CVE-2025-71091 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-71091

Vulnerability Analysis

This vulnerability arises from a logic flaw in the team network driver's queue override handling. The team driver provides network link aggregation functionality in Linux, managing multiple physical ports as a single logical interface. The vulnerable code path involves the port priority change handler, which incorrectly assumes that a port with a non-zero queue_id is still present in the queue management list.

The root issue manifests when the following sequence occurs:

1. A port is enabled with a non-zero queue_id, placing it in the qom_list (queue override management list)
2. The port gets disabled via team_port_disable(), which calls team_queue_override_port_del() to remove it from the list
3. The port is now disabled with queue_id != 0, but is not in any list
4. A priority change triggers team_queue_override_port_prio_changed(), which checks if the port is disabled AND has a non-zero queue_id
5. The function erroneously attempts to delete the port from the list again, triggering a double-free on the RCU-protected list entry

The kernel's debug list checking code detects the corruption when list_del_rcu() is called on an already-freed list entry, where the prev pointer contains LIST_POISON2 (0xdead000000000122), indicating prior deletion.

Root Cause

The root cause is an incorrect conditional check in team_queue_override_port_prio_changed(). The function checks whether the port is disabled AND has a non-zero queue_id, but this condition is insufficient to determine whether the port is actually present in the queue management list. A disabled port may have already been removed from the list, making the subsequent list deletion operation invalid and triggering a kernel BUG.

Attack Vector

An attacker with local access and the ability to manipulate network interfaces can trigger this vulnerability through the netlink interface. The attack involves:

1. Creating a team interface and adding ports with specific queue configurations
2. Disabling a port while it has a non-zero queue_id
3. Changing the priority of the disabled port via the team_nl_options_set_doit() netlink handler
4. This triggers the invalid list deletion, causing a kernel panic

The vulnerability is exploitable through the generic netlink interface (genl_rcv_msg) which handles team driver configuration options. While this typically requires elevated privileges or specific capabilities (e.g., CAP_NET_ADMIN), the impact is a complete system denial of service.

Detection Methods for CVE-2025-71091

Indicators of Compromise

• Kernel panic messages containing "list_del corruption" with LIST_POISON2 addresses
• Crash traces referencing __team_queue_override_port_del in drivers/net/team/team_core.c
• System hangs or unexpected reboots on systems using team network driver
• Kernel oops with RIP pointing to __list_del_entry_valid_or_report in lib/list_debug.c

Detection Strategies

• Monitor kernel logs for list corruption warnings using dmesg or syslog with patterns matching "list_del corruption" and "team"
• Deploy kernel crash dump analysis tools (kdump/crash) to capture and analyze kernel panics
• Use SentinelOne's kernel-level visibility to detect anomalous netlink operations targeting the team driver
• Implement auditd rules to log team interface configuration changes via netlink

Monitoring Recommendations

• Enable kernel debugging options like CONFIG_DEBUG_LIST to get early detection of list corruption
• Configure kdump to capture kernel crash dumps for post-mortem analysis
• Monitor for rapid team interface configuration changes that could indicate exploitation attempts
• Use SentinelOne Singularity platform for real-time kernel-level threat detection and alerting

How to Mitigate CVE-2025-71091

Immediate Actions Required

• Apply the latest kernel security patches from your Linux distribution vendor
• If patches are not immediately available, consider disabling or removing the team network driver module if not required
• Restrict access to network configuration capabilities (CAP_NET_ADMIN) to trusted users only
• Monitor systems using team driver link aggregation for stability issues

Patch Information

The fix modifies the check in team_queue_override_port_prio_changed() to return early if the port is not enabled, preventing the double-free condition. Multiple kernel stable tree patches are available:

• Kernel commit 107d245f84cb
• Kernel commit 53a727a8bfd7
• Kernel commit 6bfb62b6010a
• Kernel commit 932ac51d9953
• Kernel commit b71187648ef2

Workarounds

• Unload the team driver module if not in use: modprobe -r team
• Blacklist the team module in /etc/modprobe.d/ to prevent automatic loading
• Switch to alternative bonding solutions (e.g., the bonding driver) if feasible for your environment
• Implement network namespace isolation to limit exposure of team interfaces

# Temporarily disable team driver module
modprobe -r team team_mode_broadcast team_mode_roundrobin team_mode_activebackup team_mode_loadbalance

# Permanently blacklist team driver (create file /etc/modprobe.d/blacklist-team.conf)
echo "blacklist team" >> /etc/modprobe.d/blacklist-team.conf
echo "blacklist team_mode_broadcast" >> /etc/modprobe.d/blacklist-team.conf
echo "blacklist team_mode_roundrobin" >> /etc/modprobe.d/blacklist-team.conf
echo "blacklist team_mode_activebackup" >> /etc/modprobe.d/blacklist-team.conf
echo "blacklist team_mode_loadbalance" >> /etc/modprobe.d/blacklist-team.conf