CVE-2026-64190
Received Received - Intake

NULL Pointer Dereference in Linux Kernel Team Driver

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: team: fix NULL pointer dereference in team_xmit during mode change __team_change_mode() clears team->ops with memset() before restoring safe dummy handlers via team_adjust_ops(). A concurrent team_xmit() running under RCU on another CPU can read team->ops.transmit during this window and call a NULL function pointer, crashing the kernel. The race requires a mode change (CAP_NET_ADMIN) concurrent with transmit on the team device. BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: 0010 [#1] SMP KASAN NOPTI RIP: 0010:0x0 Call Trace: team_xmit (drivers/net/team/team_core.c:1853) dev_hard_start_xmit (net/core/dev.c:3904) __dev_queue_xmit (net/core/dev.c:4871) packet_sendmsg (net/packet/af_packet.c:3109) __sys_sendto (net/socket.c:2265) The original code assumed that no ports means no traffic, so mode changes could freely memset()/memcpy() the ops. AF_PACKET with forced carrier breaks that assumption. Prevent the race instead of making it safe: replace memset()/memcpy() with per-field updates that never touch transmit or receive. Those two handlers are managed solely by team_adjust_ops(), which already installs dummies when tx_en_port_count == 0 (always true during mode change since no ports are present). WRITE_ONCE/READ_ONCE prevent store/load tearing on the handler pointers. synchronize_net() before exit_op() drains in-flight readers that may still reference old mode state from before port removal switched the handlers to dummies.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-64190
EUVD
EUVD-2026-46010

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel *
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition in the Linux kernel's network teaming driver. When changing the team device mode, the kernel clears the transmit function pointer but a concurrent transmit operation on another CPU can still call this NULL pointer, causing a kernel crash. The issue occurs when a mode change (requiring admin privileges) happens simultaneously with active traffic on the team device.

Detection Guidance

This vulnerability involves a race condition in the Linux kernel's team device driver during mode changes. Detection requires checking for kernel crashes or oops messages related to team_xmit or NULL pointer dereferences in the team_core module. Monitor system logs for kernel panics or errors in drivers/net/team/team_core.c.

Impact Analysis

If exploited, this vulnerability can crash the entire system by causing a kernel panic. Systems using Linux kernel network teaming features are vulnerable. An attacker with CAP_NET_ADMIN privileges could trigger a mode change during active network traffic to force a crash.

Compliance Impact

This vulnerability is a kernel NULL pointer dereference in the Linux network teaming driver, causing system crashes. It does not directly relate to data privacy or compliance standards like GDPR or HIPAA, as it impacts system stability rather than data handling or security controls.

Mitigation Strategies

Apply the Linux kernel patch that fixes this issue. Avoid concurrent mode changes and traffic transmission on team devices. Restrict CAP_NET_ADMIN privileges to trusted users to prevent exploitation. Monitor for kernel crashes and update to a patched kernel version as soon as possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64190. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart