CVE-2026-64190: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64190 is a NULL pointer dereference vulnerability in the Linux kernel's team network driver (drivers/net/team/team_core.c) that can cause a kernel crash (denial of service). The flaw exists in the interaction between __team_change_mode() and team_xmit() during concurrent mode changes on a team network device. It affects Linux kernel versions from 3.3 onward, with fixes available in stable commits 03e9405c518c and 25fe708bbc59, and is unaffected in versions 6.18.35 and later or kernel 7.1+. The vulnerability was published on July 20, 2026, and is estimated as Medium severity (GitHub Advisory, Feedly).

The root cause is a race condition (CWE-362) in the Linux kernel team driver: __team_change_mode() uses memset() to zero out the team->ops structure before restoring safe dummy handlers via team_adjust_ops(). During this brief window, a concurrent team_xmit() executing under RCU on another CPU can read team->ops.transmit and attempt to call a NULL function pointer, triggering a kernel panic. The original design assumed no traffic would flow during mode changes (since no ports are present), but AF_PACKET with forced carrier invalidates this assumption by maintaining traffic even without active ports. The fix replaces memset()/memcpy() with per-field updates using WRITE_ONCE/READ_ONCE to prevent store/load tearing, and adds synchronize_net() before exit_op() to drain in-flight RCU readers (GitHub Advisory).

Successful exploitation causes a kernel NULL pointer dereference, crashing the affected system and resulting in a complete denial of service. The crash is triggered locally by a user with CAP_NET_ADMIN capability initiating a team device mode change while AF_PACKET traffic is concurrently transmitted on the device. There is no evidence of confidentiality or integrity impact; the sole consequence is system availability loss (GitHub Advisory, Feedly).

1. Prerequisite: Obtain a local account with CAP_NET_ADMIN capability on a Linux system running kernel version 3.3 or later with a team network device configured.
2. Set up AF_PACKET socket: Open a raw AF_PACKET socket bound to the team network interface with forced carrier enabled, ensuring traffic can flow even without active team ports.
3. Initiate concurrent traffic: Begin sending packets via the AF_PACKET socket on the team device (e.g., using sendto() in a loop), causing team_xmit() to execute on one CPU under RCU.
4. Trigger mode change: Simultaneously, use a privileged tool (e.g., teamd or ip link) to initiate a team device mode change, causing __team_change_mode() to call memset() on team->ops.
5. Race condition triggers crash: If team_xmit() reads team->ops.transmit during the memset() window, it dereferences a NULL function pointer, causing a kernel panic (BUG: kernel NULL pointer dereference, address: 0000000000000000) (GitHub Advisory).

• Logs: Kernel oops message in dmesg or /var/log/kern.log containing BUG: kernel NULL pointer dereference, address: 0000000000000000 with RIP: 0010:0x0.
• Logs: Kernel call trace referencing team_xmit (drivers/net/team/team_core.c:1853), dev_hard_start_xmit, __dev_queue_xmit, packet_sendmsg, and __sys_sendto.
• Logs: KASAN reports (Oops: 0010 [#1] SMP KASAN NOPTI) associated with the team driver.
• Process: Unexpected system reboot or kernel panic coinciding with team network device mode changes.
• Network: AF_PACKET socket activity on a team network interface concurrent with administrative mode change operations (GitHub Advisory).

Apply the upstream kernel patches fixing this issue: stable commits 03e9405c518c4d61f28079492f252d6d4e2bac5c and 25fe708bbc59289d3d1ea4b126fbc1b460a072a5. Kernel versions 6.18.35 and later, as well as 7.1+, are unaffected. As a temporary workaround, restrict CAP_NET_ADMIN to trusted users only and avoid initiating team device mode changes while active traffic is being transmitted on the device (GitHub Advisory, Feedly).