CVE-2025-71091

A list corruption vulnerability was found in the Linux kernel's network team driver. When a port is disabled and later has its priority changed, team_queue_override_port_prio_changed() incorrectly attempts to delete the port from a list it was already removed from during disable. This triggers a list_del corruption BUG when the function tries to remove an entry with LIST_POISON2 as its prev pointer.

This vulnerability can be triggered through netlink operations on team network interfaces. An unprivileged user with network namespace capabilities could potentially trigger this crash by manipulating team port priorities after disabling ports. The impact is limited to denial of service through a kernel BUG crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the team module from being loaded if network teaming is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.