VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Feb 27, 2025· Updated May 12, 2026

CVE-2025-21787

CVE-2025-21787

Description

In the Linux kernel, the following vulnerability has been resolved:

team: better TEAM_OPTION_TYPE_STRING validation

syzbot reported following splat [1]

Make sure user-provided data contains one nul byte.

[1] BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:633 [inline] BUG: KMSAN: uninit-value in string+0x3ec/0x5f0 lib/vsprintf.c:714 string_nocheck lib/vsprintf.c:633 [inline] string+0x3ec/0x5f0 lib/vsprintf.c:714 vsnprintf+0xa5d/0x1960 lib/vsprintf.c:2843 __request_module+0x252/0x9f0 kernel/module/kmod.c:149 team_mode_get drivers/net/team/team_core.c:480 [inline] team_change_mode drivers/net/team/team_core.c:607 [inline] team_mode_option_set+0x437/0x970 drivers/net/team/team_core.c:1401 team_option_set drivers/net/team/team_core.c:375 [inline] team_nl_options_set_doit+0x1339/0x1f90 drivers/net/team/team_core.c:2662 genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x1214/0x12c0 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2543 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline] netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1348 netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1892 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:733 ____sys_sendmsg+0x877/0xb60 net/socket.c:2573 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2627 __sys_sendmsg net/socket.c:2659 [inline] __do_sys_sendmsg net/socket.c:2664 [inline] __se_sys_sendmsg net/socket.c:2662 [inline] __x64_sys_sendmsg+0x212/0x3c0 net/socket.c:2662 x64_sys_call+0x2ed6/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel, the team driver lacked TEAM_OPTION_TYPE_STRING validation, leading to an uninit-value bug that could leak kernel memory.

Vulnerability

Details

The Linux kernel's team driver (drivers/net/team/team_core.c) had insufficient validation for the TEAM_OPTION_TYPE_STRING option type. When a user sets a team option via netlink, the driver did not ensure that the user-provided data contains a null byte. This could result in an uninitialized value being passed to string formatting functions like vsprintf, as reported by syzbot [description].

Exploitation

An attacker with CAP_NET_ADMIN privileges (necessary to configure team devices) can trigger this bug by sending a crafted netlink message to set a team option with a string lacking a null terminator. This causes the kernel to call string_nocheck on uninitialized data during team_mode_get, which can lead to information disclosure via kernel log messages or other output mechanisms [1].

Impact

The vulnerability is classified as a medium-severity information leak (CVSS 5.5). An attacker could read portions of kernel memory, potentially exposing sensitive data. The uninit-value bug manifests as an uninitialized memory access, which can be observed through kernel splats or error logs.

Mitigation

Patches have been merged into the Linux kernel stable branches. The fix commits are identifiable by hashes [2], [3], [4] (though the patch pages are behind a bot wall). Affected products include Siemens SIMATIC S7-1500 TM MFP with GNU/Linux subsystem, which is listed as affected by this and many other CVEs [1]. Users and vendors should update to the latest kernel version to address this vulnerability.

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

164

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.