In the Linux kernel, the following vulnerability has been resolved:
team: better TEAMOPTIONTYPE_STRING validation
syzbot reported following splat [1]
Make sure user-provided data contains one nul byte.
[1] BUG: KMSAN: uninit-value in stringnocheck lib/vsprintf.c:633 [inline] BUG: KMSAN: uninit-value in string+0x3ec/0x5f0 lib/vsprintf.c:714 stringnocheck lib/vsprintf.c:633 [inline] string+0x3ec/0x5f0 lib/vsprintf.c:714 vsnprintf+0xa5d/0x1960 lib/vsprintf.c:2843 __requestmodule+0x252/0x9f0 kernel/module/kmod.c:149 teammode_get drivers/net/team/teamcore.c:480 [inline] teamchangemode drivers/net/team/teamcore.c:607 [inline] teammodeoptionset+0x437/0x970 drivers/net/team/teamcore.c:1401 teamoptionset drivers/net/team/teamcore.c:375 [inline] teamnloptionssetdoit+0x1339/0x1f90 drivers/net/team/teamcore.c:2662 genlfamilyrcvmsgdoit net/netlink/genetlink.c:1115 [inline] genlfamilyrcvmsg net/netlink/genetlink.c:1195 [inline] genlrcvmsg+0x1214/0x12c0 net/netlink/genetlink.c:1210 netlinkrcvskb+0x375/0x650 net/netlink/afnetlink.c:2543 genlrcv+0x40/0x60 net/netlink/genetlink.c:1219 netlinkunicastkernel net/netlink/afnetlink.c:1322 [inline] netlinkunicast+0xf52/0x1260 net/netlink/afnetlink.c:1348 netlinksendmsg+0x10da/0x11e0 net/netlink/afnetlink.c:1892 socksendmsgnosec net/socket.c:718 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:733 ____sys_sendmsg+0x877/0xb60 net/socket.c:2573 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2627 __sys_sendmsg net/socket.c:2659 [inline] __dosyssendmsg net/socket.c:2664 [inline] __sesyssendmsg net/socket.c:2662 [inline] _x64syssendmsg+0x212/0x3c0 net/socket.c:2662 x64syscall+0x2ed6/0x3c30 arch/x86/include/generated/asm/syscalls64.h:47 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xcd/0x1e0 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x77/0x7f
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21787.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21787.json"
[
{
"signature_version": "v1",
"target": {
"file": "drivers/net/team/team.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c30483d0f6bdb2230e10e3e4be5167927eac7a0",
"deprecated": false,
"digest": {
"line_hashes": [
"273878767782786829601096902496752525538",
"221096492177575854940986276480589042115",
"199857280939128835815251365023174897917",
"216467511455628833193087634690525568610"
],
"threshold": 0.9
},
"id": "CVE-2025-21787-0eaa0681",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/net/team/team.c",
"function": "team_nl_cmd_options_set"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c30483d0f6bdb2230e10e3e4be5167927eac7a0",
"deprecated": false,
"digest": {
"function_hash": "275113757477950732706994055386227353160",
"length": 2928.0
},
"id": "CVE-2025-21787-727e2a03",
"signature_type": "Function"
}
]