CVE-2026-64190: Linux Kernel Race Condition Vulnerability

CVE-2026-64190 Overview

CVE-2026-64190 is a NULL pointer dereference vulnerability in the Linux kernel's network team driver. The flaw resides in the team_xmit() function and is triggered by a race condition during team mode changes. When __team_change_mode() clears team->ops with memset() before restoring safe dummy handlers via team_adjust_ops(), a concurrent team_xmit() running under RCU on another CPU can read team->ops.transmit during this window and call a NULL function pointer. The result is a kernel crash. Triggering the condition requires CAP_NET_ADMIN to change the team mode concurrent with transmit activity on the team device.

Critical Impact
A local attacker with CAP_NET_ADMIN can crash the kernel by racing a team mode change against packet transmission on a team network device.

Affected Products

Linux kernel versions containing the drivers/net/team/team_core.c team driver prior to the fix commits
Distributions shipping vulnerable stable kernel branches
Systems using the team network driver with AF_PACKET senders that force carrier

Discovery Timeline

2026-07-20 - CVE-2026-64190 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64190

Vulnerability Analysis

The Linux kernel team driver aggregates multiple network interfaces into a single logical device. Each team instance stores mode-specific operations in a team->ops structure containing function pointers, including transmit and receive handlers. The team driver supports runtime mode changes through the __team_change_mode() function.

During a mode change, __team_change_mode() calls memset() on team->ops to zero the structure, then calls team_adjust_ops() to install safe dummy handlers. Between these two operations, team->ops.transmit is a NULL pointer. A concurrent packet transmit on another CPU can dereference this NULL pointer and trigger a kernel oops.

The original code assumed no ports meant no traffic, so mode changes could freely memset() and memcpy() the ops structure. This assumption breaks when AF_PACKET sockets force carrier state and inject traffic during the transition window.

Root Cause

The root cause is a race condition [CWE-362] combined with a NULL pointer dereference [CWE-476] in drivers/net/team/team_core.c. team_xmit() executes under RCU without holding the mutex that guards mode changes. The non-atomic memset() on the ops structure creates a window where the transmit handler pointer is NULL while transmit paths are still active.

Attack Vector

An attacker with CAP_NET_ADMIN can trigger the race by repeatedly changing the team device mode while another process sends packets through the same team device. The crash trace observed in the wild shows the following path: team_xmit → dev_hard_start_xmit → __dev_queue_xmit → packet_sendmsg → __sys_sendto. Successful triggering results in a denial of service via kernel panic.

The upstream fix replaces the memset() and memcpy() operations with per-field updates that never touch the transmit or receive handlers. Those two handlers remain managed exclusively by team_adjust_ops(), which installs dummy handlers when tx_en_port_count == 0. WRITE_ONCE and READ_ONCE primitives prevent store and load tearing on the handler pointers, and synchronize_net() before exit_op() drains in-flight readers that may still reference stale mode state.

Detection Methods for CVE-2026-64190

Indicators of Compromise

Kernel oops messages referencing BUG: kernel NULL pointer dereference, address: 0000000000000000 with a call trace including team_xmit and dev_hard_start_xmit
Unexpected kernel panics on hosts using the team network driver
dmesg entries showing RIP set to 0x0 immediately following administrative changes to team device mode

Detection Strategies

Audit auditd records for setsockopt and netlink operations that change team mode combined with concurrent AF_PACKET sendto activity from unprivileged workloads
Monitor for processes holding CAP_NET_ADMIN that repeatedly reconfigure team devices within short time windows
Correlate crash dumps and kdump output against the specific call stack signature: team_xmit → dev_hard_start_xmit → __dev_queue_xmit → packet_sendmsg

Monitoring Recommendations

Ingest dmesg and /var/log/kern.log into a centralized log platform and alert on NULL pointer dereference oopses referencing the team driver
Track running kernel versions across the fleet and flag hosts still running vulnerable builds of drivers/net/team/team_core.c
Alert on unexpected reboots of hosts running team-bonded network interfaces, particularly on virtualization hypervisors and container hosts

How to Mitigate CVE-2026-64190

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits 03e9405c518c4d61f28079492f252d6d4e2bac5c and 25fe708bbc59289d3d1ea4b126fbc1b460a072a5
Update to distribution-provided kernel packages that incorporate the fix once available from your Linux vendor
Restrict CAP_NET_ADMIN to trusted administrative accounts and remove it from container workloads that do not require it

Patch Information

The fix replaces memset() and memcpy() on team->ops with per-field updates that never touch the transmit or receive handlers. WRITE_ONCE and READ_ONCE prevent tearing on the handler pointers, and synchronize_net() drains in-flight RCU readers before exit_op(). Patch details are available in the Kernel Git Commit 03e9405 and Kernel Git Commit 25fe708b.

Workarounds

Unload the team kernel module on hosts that do not require team-based link aggregation by running modprobe -r team
Migrate affected workloads to the bonding driver as an alternative link aggregation mechanism where feasible
Drop CAP_NET_ADMIN from container and namespace configurations that do not need to reconfigure network devices

bash

# Configuration example: blocklist the team module to prevent load
echo 'blacklist team' | sudo tee /etc/modprobe.d/blacklist-team.conf
sudo modprobe -r team