CVE-2025-21787

What it actually does

Missing null-byte validation on user-controlled TEAM_OPTION_TYPE_STRING values allows uninitialized kernel memory to be passed into vsnprintf during __request_module calls triggered by team mode changes.

Why it matters to the business

Local users on affected Linux systems can trigger kernel crashes or denial-of-service when manipulating team network device options, increasing operational risk on servers and containers using the team driver.

How an attack unfolds

An attacker with local privileges crafts a netlink message that sets a team option string lacking a terminating null byte; this flows through team_nl_options_set_doit into team_mode_option_set, causing the uninitialized value to reach string formatting inside __request_module and produce a KMSAN splat or crash.

How to fix it

Apply the upstream fix by updating the Linux kernel source to commit 7c30483d0f6bdb2230e10e3e4be5167927eac7a0 or later; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 7c30483d0f6bdb2230e10e3e4be5167927eac7a0; attempt to reproduce the original syzbot reproducer and verify no KMSAN report occurs.

Typical attack path

1. Obtain local user or container access on a system with the team kernel module loaded
2. Use netlink sockets to invoke TEAM_CMD_OPTIONS_SET with a string option missing a null terminator
3. Trigger team_change_mode path that calls team_mode_get and subsequently __request_module
4. Cause vsnprintf to consume uninitialized memory, resulting in kernel fault or panic

How to detect it

Search kernel logs for KMSAN or BUG reports mentioning string_nocheck, vsnprintf, __request_module, team_mode_option_set, or team_nl_options_set_doit; correlate with netlink activity on team sockets.

What your security team should do

• Prioritize kernel updates containing commit 7c30483d0f6bdb2230e10e3e4be5167927eac7a0 on all production systems using the team driver
• Restrict unprivileged local access and netlink usage where team interfaces are not required
• Monitor for kernel oops or KMSAN reports referencing team_mode_option_set or vsnprintf after deployment