CVE-2025-71091: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71091 is a logic error vulnerability in the Linux kernel's team network driver that allows a local low-privileged attacker to trigger a kernel panic (denial of service) via netlink socket commands. The flaw resides in the team_queue_override_port_prio_changed() function in drivers/net/team/team_core.c, where the function fails to validate whether a port is enabled before attempting to remove it from a linked list. Affected Linux kernel versions span from 3.11.1 through 5.10.247, 5.11 through 5.15.197, 5.16 through 6.1.159, 6.2 through 6.6.119, 6.7 through 6.12.63, and 6.13 through 6.18.3, as well as Microsoft Azure Linux 3 kernel 6.6.119.3-3. It was published on January 13, 2026, with a CVSS v3.1 base score of 7.8 (High) (Feedly, Microsoft MSRC).

The root cause is a logic error (CWE-416 / improper state validation) in team_queue_override_port_prio_changed(): when a team port is first enabled with a non-zero queue_id, it is added to the queue override list; when the port is subsequently disabled, it is removed from that list. However, if the port's priority is changed while it is in the disabled state, the function incorrectly attempts to delete the port from the list a second time, causing a list_del corruption kernel BUG (LIST_POISON2 pointer dereference) (Feedly). The attack vector is local, requiring only low privileges and no user interaction — an attacker with access to netlink sockets can craft a sequence of team driver commands (enable port with non-zero queue_id → disable port → change port priority) to trigger the invalid opcode exception. The syzkaller fuzzer identified this bug, and the kernel trace shows the crash at __list_del_entry_valid_or_report+0x13e/0x200 lib/list_debug.c:59 (Feedly).

Successful exploitation causes a kernel panic (invalid opcode exception), resulting in a complete denial of service by crashing the affected system. Because the attack requires only low privileges and no user interaction, any local user with access to netlink sockets on a vulnerable system can crash the host. There is no evidence of confidentiality or integrity impact beyond the system crash itself; however, in shared or multi-tenant environments (e.g., cloud VMs, containers with host network access), this could be leveraged to disrupt services or force a reboot (Feedly).

1. Gain local access: Obtain a local shell on the target system with low-privilege user credentials and access to netlink sockets (standard on most Linux systems).
2. Load/verify team driver: Confirm the team kernel module is loaded (lsmod | grep team); if not, attempt to load it (modprobe team) if permitted.
3. Create a team interface: Use ip link add name team0 type team to create a team network interface.
4. Add a port with non-zero queue_id: Add a slave interface to the team with a non-zero queue_id (e.g., via teamdctl or direct netlink commands), causing the port to be added to the queue override list.
5. Disable the port: Remove or disable the port from the team, which removes it from the queue override list.
6. Change port priority while disabled: Issue a netlink command to change the disabled port's priority setting, triggering team_queue_override_port_prio_changed() to attempt a duplicate list deletion.
7. Kernel panic triggered: The kernel detects list corruption (LIST_POISON2 pointer) and fires a BUG, crashing the system with an invalid opcode exception (Feedly).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing list_del corruption errors, specifically ffff...->prev is LIST_POISON2 (dead000000000122), followed by kernel BUG at lib/list_debug.c:59.
• Logs: Kernel oops trace referencing __list_del_entry_valid_or_report+0x13e/0x200 and the team driver in the call stack.
• Logs: Unexpected system reboots or kernel panic entries in system logs coinciding with team driver netlink activity.
• Process: Unusual processes invoking netlink socket operations against team network interfaces, particularly sequences of enable/disable/priority-change commands in rapid succession.
• Network: Creation of team type network interfaces by non-administrative users, detectable via ip link show type team or audit logs for RTM_NEWLINK netlink messages.

Apply the available kernel patches for your distribution branch: upgrade to kernel 5.10.248+, 5.15.198+, 6.1.160+, 6.6.120+, 6.12.64+, or 6.18.4+ as appropriate. Microsoft Azure Linux 3 users should update to azl3_kernel_6.6.119.3-3 or later. Debian, Ubuntu (USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1), Amazon Linux 2, and Oracle Linux have all released patched kernel packages (Feedly, Microsoft MSRC). As a temporary workaround where patching is not immediately possible, restrict access to netlink sockets and team driver configuration to trusted administrators only (e.g., via CAP_NET_ADMIN restrictions or seccomp policies), and consider blacklisting the team kernel module (echo 'blacklist team' >> /etc/modprobe.d/blacklist.conf) if the team driver is not required.