---
id: CVE-2026-31502
title: 'team: fix header_ops type confusion with non-Ethernet ports'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  team: fix header_ops type confusion with non-Ethernet ports

  Similar to commit 950803f72547 ("bonding: fix type confusion in
  bond_setup_by_slave()") team has the same c…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1d76efe1577b4323609b1bcbfafa8b731eda071a <
    420e5aad7ba89e8f79e2dc8327b0c0c24c1c1d53
  - >-
    Linux >= 1d76efe1577b4323609b1bcbfafa8b731eda071a <
    6d3161fa3eee64d46b766fb0db33ec7f300ef52d
  - >-
    Linux >= 1d76efe1577b4323609b1bcbfafa8b731eda071a <
    0a7468ed49a6b65d34abcc6eb60e15f7f6d34da0
  - >-
    Linux >= 1d76efe1577b4323609b1bcbfafa8b731eda071a <
    20491d384d973a63fbdaf7a71e38d69b0659ea55
  - >-
    Linux >= 1d76efe1577b4323609b1bcbfafa8b731eda071a <
    425000dbf17373a4ab8be9428f5dc055ef870a56
  - Linux 3.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:10:14.938095Z'
published: '2026-04-22'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:13.329Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31502'
references:
  - url: 'https://git.kernel.org/stable/c/420e5aad7ba89e8f79e2dc8327b0c0c24c1c1d53'
  - url: 'https://git.kernel.org/stable/c/6d3161fa3eee64d46b766fb0db33ec7f300ef52d'
  - url: 'https://git.kernel.org/stable/c/0a7468ed49a6b65d34abcc6eb60e15f7f6d34da0'
  - url: 'https://git.kernel.org/stable/c/20491d384d973a63fbdaf7a71e38d69b0659ea55'
  - url: 'https://git.kernel.org/stable/c/425000dbf17373a4ab8be9428f5dc055ef870a56'
tags:
  - cve.org
epss: 0.00129
epssPercentile: 0.02223
ingestedAt: '2026-10-16T17:24:46.657Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

team: fix header_ops type confusion with non-Ethernet ports

Similar to commit 950803f72547 ("bonding: fix type confusion in
bond_setup_by_slave()") team has the same class of header_ops type
confusion.

For non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops
directly. When the team device later calls dev_hard_header() or
dev_parse_header(), these callbacks can run with the team net_device
instead of the real lower device, so netdev_priv(dev) is interpreted as
the wrong private type and can crash.

The syzbot report shows a crash in bond_header_create(), but the root
cause is in team: the topology is gre -> bond -> team, and team calls
the inherited header_ops with its own net_device instead of the lower
device, so bond_header_create() receives a team device and interprets
netdev_priv() as bonding private data, causing a type confusion crash.

Fix this by introducing team header_ops wrappers for create/parse,
selecting a team port under RCU, and calling the lower device callbacks
with port->dev, so each callback always sees the correct net_device
context.

Also pass the selected lower device to the lower parse callback, so
recursion is bounded in stacked non-Ethernet topologies and parse
callbacks always run with the correct device context.

## Affected

- `Linux >= 1d76efe1577b4323609b1bcbfafa8b731eda071a < 420e5aad7ba89e8f79e2dc8327b0c0c24c1c1d53`
- `Linux >= 1d76efe1577b4323609b1bcbfafa8b731eda071a < 6d3161fa3eee64d46b766fb0db33ec7f300ef52d`
- `Linux >= 1d76efe1577b4323609b1bcbfafa8b731eda071a < 0a7468ed49a6b65d34abcc6eb60e15f7f6d34da0`
- `Linux >= 1d76efe1577b4323609b1bcbfafa8b731eda071a < 20491d384d973a63fbdaf7a71e38d69b0659ea55`
- `Linux >= 1d76efe1577b4323609b1bcbfafa8b731eda071a < 425000dbf17373a4ab8be9428f5dc055ef870a56`
- `Linux 3.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.