CVE-2026-31502

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

team: fix header_ops type confusion with non-Ethernet ports

Similar to commit 950803f72547 ("bonding: fix type confusion in

bond_setup_by_slave()") team has the same class of header_ops type

confusion.

For non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops

directly. When the team device later calls dev_hard_header() or

dev_parse_header(), these callbacks can run with the team net_device

instead of the real lower device, so netdev_priv(dev) is interpreted as

the wrong private type and can crash.

The syzbot report shows a crash in bond_header_create(), but the root

cause is in team: the topology is gre -> bond -> team, and team calls

the inherited header_ops with its own net_device instead of the lower

device, so bond_header_create() receives a team device and interprets

netdev_priv() as bonding private data, causing a type confusion crash.

Fix this by introducing team header_ops wrappers for creat

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References