CVE-2025-68340: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68340 is a Linux kernel vulnerability in the team network device driver where the device type change operation (team_dev_type_check_change) is performed before all validation checks complete in team_port_add, leaving the device in an inconsistent state if subsequent checks fail. This affects Linux kernel versions 3.7 through 5.15.198, 5.16 through 6.1.161, 6.2 through 6.6.122, 6.7 through 6.12.60, 6.13 through 6.17.10, and 6.18-rc1 through 6.18-rc7. It was disclosed on December 23, 2025, with a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a logic ordering flaw (CWE-667: Improper Locking / state management) in the team_port_add function of the Linux kernel's team driver. When a port device that is already in the UP state is added to a team device, team_dev_type_check_change modifies the team device's header_ops (e.g., changing eth_header to ipgre_header) before all prerequisite validation checks pass. If a subsequent check fails, the header_ops change cannot be rolled back, resulting in a type mismatch where ipgre_header() is called but the device's private data still holds a struct team instead of a struct ip_tunnel. The fix moves team_dev_type_check_change to the end of team_port_add after all checks have passed, and adds a conditional to preserve correct MTU assignment semantics (Red Hat Bugzilla).

A local attacker with low privileges can trigger kernel hangs, BUG() assertions, or a denial of service by using standard iproute2 commands to add an already-UP incompatible network device (e.g., a GRE tunnel) as a port of a team interface. The resulting memory corruption — where ipgre_header() dereferences a struct team pointer as a struct ip_tunnel — affects system availability but has no confidentiality or integrity impact. The vulnerability is confined to the local system and does not enable lateral movement or data exfiltration (Red Hat Advisory).

1. Gain local access: Obtain a low-privileged local shell on a vulnerable Linux system running kernel versions 3.7–5.15.198, 5.16–6.1.161, 6.2–6.6.122, 6.7–6.12.60, or 6.13–6.17.10.
2. Create a team interface: Run ip link add dev team0 type team to create a new team network device.
3. Create and bring up a GRE tunnel: Run ip link add dev gre0 type gre followed by ip link set dev gre0 up to create a GRE tunnel device in the UP state.
4. Attempt to add the UP device as a team port: Run ip link set dev gre0 master team0. This fails validation (gre0 is already UP), but not before team_dev_type_check_change modifies team0's header_ops from eth_header to ipgre_header.
5. Trigger the inconsistent state: Run ip link set dev team0 up followed by ping -I team0 1.1.1.1. When the kernel invokes ipgre_header(), it dereferences the device's private data as a struct ip_tunnel*, but the data is actually a struct team, causing a kernel hang or BUG() (Red Hat Bugzilla).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing BUG() assertions or kernel oops traces referencing ipgre_header, team_port_add, or team_dev_type_check_change; kernel hang messages or RCU stall warnings following team device configuration.
• Process/Command: Unusual use of ip link commands by non-root users creating team interfaces and adding GRE tunnel devices as ports; repeated failed ip link set dev <gre_dev> master <team_dev> commands in shell history or audit logs.
• Network: Unexpected team network interfaces (ip link show type team) present on systems where team bonding is not part of normal configuration.

Apply kernel updates to the following patched versions depending on your kernel series: 5.15.199 or later, 6.1.162 or later, 6.6.123 or later, 6.12.61 or later, or 6.17.11 or later. Patches have been committed to the Linux stable repository and are available across multiple stable branches. Distribution-specific updates are available from Debian (DLA-4476-1), Ubuntu (USN-8162-1, USN-8180-x, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1), Amazon Linux 2 (ALAS2KERNEL-5.15-2026-098/099), Oracle Linux, and Microsoft Azure Linux (CBL-Mariner). As a workaround prior to patching, restrict local user privileges to prevent creation of team and GRE tunnel interfaces, and avoid dynamic reconfiguration of team devices with incompatible device types (Red Hat Advisory, Red Hat Bugzilla).