CVE-2026-64190 in Linux
Summary
by MITRE • 07/20/2026
In the Linux kernel, the following vulnerability has been resolved:
net: team: fix NULL pointer dereference in team_xmit during mode change
__team_change_mode() clears team->ops with memset() before restoring safe dummy handlers via team_adjust_ops(). A concurrent team_xmit() running under RCU on another CPU can read team->ops.transmit during this window and call a NULL function pointer, crashing the kernel.
The race requires a mode change (CAP_NET_ADMIN) concurrent with transmit on the team device.
BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: 0010 [#1] SMP KASAN NOPTI
RIP: 0010:0x0 Call Trace: team_xmit (drivers/net/team/team_core.c:1853) dev_hard_start_xmit (net/core/dev.c:3904) __dev_queue_xmit (net/core/dev.c:4871) packet_sendmsg (net/packet/af_packet.c:3109) __sys_sendto (net/socket.c:2265)
The original code assumed that no ports means no traffic, so mode changes could freely memset()/memcpy() the ops. AF_PACKET with forced carrier breaks that assumption.
Prevent the race instead of making it safe: replace memset()/memcpy() with per-field updates that never touch transmit or receive. Those two handlers are managed solely by team_adjust_ops(), which already installs dummies when tx_en_port_count == 0 (always true during mode change since no ports are present). WRITE_ONCE/READ_ONCE prevent store/load tearing on the handler pointers.
synchronize_net() before exit_op() drains in-flight readers that may still reference old mode state from before port removal switched the handlers to dummies.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists within the Linux kernel's team driver implementation where a race condition can lead to a kernel crash through NULL pointer dereference during network device mode transitions. The issue specifically occurs in the team_xmit function which handles packet transmission for team devices, where concurrent execution paths create an unsafe window during mode changes that can result in system instability.
The technical flaw stems from improper synchronization during the mode change process within the __team_change_mode() function. This function clears the team->ops structure using memset() before restoring safe dummy handlers through team_adjust_ops(). During this brief window, if another CPU core is executing team_xmit() under RCU protection, it can read the team->ops.transmit function pointer which has been zeroed out but not yet replaced with valid dummy handlers. This creates a NULL pointer dereference scenario that crashes the kernel with a kernel oops and NULL pointer exception.
The vulnerability requires specific conditions to manifest including concurrent execution of mode change operations with CAP_NET_ADMIN privileges and active packet transmission on the team device. The race condition is particularly dangerous because it can occur during normal network operations when ports are being added or removed, especially in scenarios involving AF_PACKET sockets with forced carrier states that contradict the original assumption that no ports means no traffic.
According to CWE-362, this represents a concurrent execution race condition where multiple threads access shared data without proper synchronization mechanisms. The vulnerability also maps to ATT&CK technique T1059.003 for kernel-level code injection and T1484.001 for privilege escalation through kernel exploitation. The specific implementation flaw violates proper atomic operations principles for shared memory access patterns, particularly in multi-CPU environments where RCU (Read-Copy-Update) mechanisms are employed.
The proposed fix addresses the root cause by replacing the problematic memset()/memcpy() pattern with per-field updates that specifically avoid modifying the transmit and receive function pointers. This approach ensures that only non-critical fields of the ops structure are modified during the mode change, while the critical handler pointers are exclusively managed by team_adjust_ops() which already correctly implements dummy handler installation when no ports are present. The solution employs WRITE_ONCE/READ_ONCE macros to prevent store/load tearing on handler pointer updates and uses synchronize_net() before exit_op() to ensure all in-flight readers complete their operations with the previous mode state before the handlers are switched to dummy implementations.
The mitigation strategy prevents the race condition rather than attempting to make it safe, which is a more robust approach that eliminates the window of vulnerability entirely. This solution maintains backward compatibility while ensuring kernel stability during concurrent network device management operations and addresses the fundamental architectural flaw in how shared data structures are updated during mode transitions. The fix specifically targets the scenario where port removal causes a switch to dummy handlers, making the mode change process safe regardless of concurrent packet transmission activities.