SB2025090872 - Improper locking in Linux kernel net team driver

Description

This security bulletin contains information about 1 security vulnerability.

1) Improper locking (CVE-ID: CVE-2025-39733)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the lb_bpf_func_set(), lb_bpf_func_free(), lb_tx_method_get() and lb_stats_refresh() functions in drivers/net/team/team_mode_loadbalance.c, within the ab_active_port_get() function in drivers/net/team/team_mode_activebackup.c, within the team_port_find(), team_init(), team_uninit(), team_change_rx_flags(), team_set_mac_address(), team_change_mtu(), list_for_each_entry_continue_reverse(), team_vlan_rx_add_vid(), team_vlan_rx_kill_vid(), team_netpoll_cleanup(), team_netpoll_setup(), team_add_slave(), team_del_slave(), team_nl_team_get(), team_nl_options_get_doit(), team_nl_port_list_get_doit() and __team_port_change_port_removed() functions in drivers/net/team/team_core.c. A local user can perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/53edc761c9911f597b6d701e846f6e84f15eaa6d
• https://git.kernel.org/stable/c/556a4337ba3e9a70e1e3a428e8465c3ea3c4aa41
• https://git.kernel.org/stable/c/bfb4fb77f9a8ce33ce357224569eae5564eec573