CVE-2025-21787team: better TEAM_OPTION_TYPE_STRING validation
- 5.5MediumCVSS base score
- 0.27%Exploitation in 30 daysEPSS · top 80% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: team: better TEAM_OPTION_TYPE_STRING validation syzbot reported following splat [1] Make sure user-provided data contains one nul byte. [1] BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:633 [inline] BUG: KMSAN: uninit-value in string+0x3ec/0x5f0 lib/vsprintf.c:714 string_nocheck lib/vsprintf.c:633 [inline] string+0x3ec/0x5f0 lib/vsprintf.c:714 vsnprintf+0xa5d/0x1960 lib/vsprintf.c:2843 __request_module+0x252/0x9f0 kernel/module/kmod.c:149 team_mode_get drivers/net/team/team_core.c:480 [inline] team_change_mode drivers/net/team/team_core.c:607 [inline] team_mode_option_set+0x437/0x970 drivers/net/team/team_core.c:1401 team_option_set drivers/net/team/team_core.c:375 [inline] team_nl_options_set_doit+0x1339/0x1f90 drivers/net/team/team_core.c:2662 genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x1214/0x12c0 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2543 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline] netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1348 netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1892 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:733 ____sys_sendmsg+0x877/0xb60 net/socket.c:2573 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2627 __sys_sendmsg net/socket.c:2659 [inline] __do_sys_sendmsg net/socket.c:2664 [inline] __se_sys_sendmsg net/socket.c:2662 [inline] __x64_sys_sendmsg+0x212/0x3c0 net/socket.c:2662 x64_sys_call+0x2ed6/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Timeline
ID reserved
By Linux
- 2 months later
· 2 months later
Published
- 20 months later
· 20 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.27% · top 80% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 – < 7c30483d0f6bdb2230e10e3e4be5167927eac7a0
- affected 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 – < 7f5af50f3aa0af8cbef9fb76fffeed69e8143f59
- affected 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 – < f443687ad20c70320d1248f35f57bf46cac8df0a
- affected 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 – < 4512482e4805dd30bc77dec511f2a2edba5cb868
- affected 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 – < d071a91fa614ecdf760c29f61f6a7bfb7df796d6
- affected 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 – < 4236bf4716589558cc0f3c3612642b2c2141b04e
- affected 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 – < 8401cade1918281177974b32c925afdce750d292
- affected 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80 – < 5bef3ac184b5626ea62385d6b82a1992b89d7940
- affected 3.3
- unaffected < 3.3
- unaffected 5.4.291 – ≤ 5.4.*
- unaffected 5.10.235 – ≤ 5.10.*
- unaffected 5.15.179 – ≤ 5.15.*
- unaffected 6.1.129 – ≤ 6.1.*
- unaffected 6.6.79 – ≤ 6.6.*
- unaffected 6.12.16 – ≤ 6.12.*
- unaffected 6.13.4 – ≤ 6.13.*
- unaffected 6.14 – ≤ *
References
References12
- https://git.kernel.org/stable/c/7c30483d0f6bdb2230e10e3e4be5167927eac7a0 (opens in a new tab)
- https://git.kernel.org/stable/c/7f5af50f3aa0af8cbef9fb76fffeed69e8143f59 (opens in a new tab)
- https://git.kernel.org/stable/c/f443687ad20c70320d1248f35f57bf46cac8df0a (opens in a new tab)
- https://git.kernel.org/stable/c/4512482e4805dd30bc77dec511f2a2edba5cb868 (opens in a new tab)
- https://git.kernel.org/stable/c/d071a91fa614ecdf760c29f61f6a7bfb7df796d6 (opens in a new tab)
- https://git.kernel.org/stable/c/4236bf4716589558cc0f3c3612642b2c2141b04e (opens in a new tab)
- https://git.kernel.org/stable/c/8401cade1918281177974b32c925afdce750d292 (opens in a new tab)
- https://git.kernel.org/stable/c/5bef3ac184b5626ea62385d6b82a1992b89d7940 (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-5139 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-21787)Record last updated .