The vulnerability in the Linux kernel is a type confusion flaw that occurs when a team network device, configured on a non‑Ethernet port, copies the port’s header_ops directly. When the team device later calls dev_hard_header or dev_parse_header, the wrong private data is interpreted as belonging to the team device, leading to a kernel crash. The crash is triggered by a misguided call to the bonding stack where the lower device’s header_ops receives a team device context, causing an incorrect netdev_priv interpretation and a type confusion fault.

All Linux kernel implementations that include the team networking framework are affected; no specific kernel version range is listed, so any kernel before the commit that introduced the fix is potentially vulnerable.

The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog, indicating limited publicly known exploitation. Based on the description, it is inferred that an attacker could trigger the bug by sending crafted network traffic to a team device configured on a non‑Ethernet port, potentially allowing a remote attacker to induce a kernel panic and disrupt service. The CVSS score of 7.8 reflects the high‑severity potential for denial of service due to a kernel crash.