Linux Kernel CVE-2026-31502

Requires Linux kernel with CONFIG_NET_TEAM enabled (common in most distributions). System must have team network device configured with non-Ethernet lower devices - specifically GRE, IPIP, SIT tunnels, or other non-Ethernet interfaces as team ports, often in nested stacking like 'gre → bond → team'. This is NOT a default configuration; standard team deployments use Ethernet interfaces only. Attacker needs local authenticated access with sufficient privileges to trigger network operations (typically CAP_NET_ADMIN to configure, or ability to send packets through the team interface). The vulnerability is triggered during packet transmission when dev_hard_header() or dev_parse_header() is invoked on the team device. Standard Ethernet-only team configurations are not vulnerable - the specific non-Ethernet lower device requirement significantly limits real-world attack surface.

Despite a CVSS base score of 7.8 (High), real-world risk appears limited based on multiple signals. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms local access with low-privilege authentication is required - this is not a remote network attack. EPSS exploitation probability of 0.02% (5th percentile) indicates security researchers assess actual exploitation likelihood as very low. No CISA KEV listing exists, and no public exploit code has been identified at time of analysis. Exploitation requires specific stacked network topologies (non-Ethernet devices like GRE or IPIP aggregated under team driver) combined with local access to trigger network operations - a narrow attack surface. The vulnerability's impact (memory corruption potentially leading to privilege escalation) is severe IF exploited, but the prerequisite configuration is uncommon in production environments. Patches are widely available across all active kernel branches. Priority should be moderate: apply patches during regular maintenance windows unless systems specifically use team driver with non-Ethernet lower devices, in which case urgency increases.

A local attacker with low-privilege user access on a Linux system configured with stacked network topology (e.g., GRE tunnel enslaved to bonding interface, bonding enslaved to team device) triggers network packet transmission through the team interface. The team driver's header_ops callbacks execute with incorrect device context, causing netdev_priv() type confusion that corrupts kernel memory. The attacker leverages this memory corruption to escalate privileges to root or cause denial of service through kernel crash.