CVE-2026-64190

What it actually does

This is a Linux kernel race condition in the network team driver. During a team device mode change, the kernel briefly clears the team operations table before restoring safe handler functions. If packet transmission occurs on another CPU during that window, team_xmit() can read a NULL transmit function pointer and call it, causing a kernel NULL pointer dereference and likely system crash. Exploitation requires the ability to trigger a team mode change, typically CAP_NET_ADMIN, while concurrently sending traffic through the team device, such as via AF_PACKET behavior with forced carrier. The practical impact is local denial of service rather than code execution based on the provided details.

Why it matters to the business

A user or workload with elevated network administration privileges could crash an affected Linux system, interrupting services, workloads, and network connectivity on that host. The risk is highest on systems that use Linux network teaming and grant CAP_NET_ADMIN to containers, automation, or non-fully-trusted local users. Current available intelligence indicates low EPSS probability, no known KEV listing, no ransomware association, and no public exploit maturity, so broad internet-scale exploitation is unlikely; however, privileged local denial-of-service risk remains operationally relevant for multi-tenant Linux hosts and container platforms.

How an attack unfolds

An attacker first needs local execution in a context that can administer network interfaces, specifically the ability to change the mode of a Linux team device. They then arrange for traffic to be transmitted through the team interface at the same time the team mode is being changed. Under the vulnerable implementation, __team_change_mode() clears the team operations structure, creating a narrow race window. If team_xmit() runs during that window on another CPU, it may read team->ops.transmit as NULL and attempt to call address 0x0. This produces a kernel oops or panic, terminating the host or destabilizing networking. The attacker’s objective is to win the timing race reliably enough to cause denial of service.

How to fix it

Apply a vendor-supplied Linux kernel update that contains the upstream fix for this issue. The fix avoids clearing transmit and receive handler pointers during mode changes, uses safe per-field updates, and relies on synchronization to drain in-flight network readers. If no fixed package version is listed by the distribution yet, track the relevant kernel advisory for CVE-2026-64190 and upgrade to the first kernel build that includes the net/team fix. As interim mitigations, avoid using Linux network teaming where not required, unload or block the team kernel module if unused, restrict CAP_NET_ADMIN to trusted administrative contexts only, avoid privileged containers with broad network capabilities, and prefer alternative bonding or networking configurations if supported and patched by the platform.

How to confirm the fix worked

Confirm exposure by checking whether the system runs an affected Linux kernel and whether the network team driver is present or in use. Useful checks include reviewing the installed kernel package changelog/advisory for the CVE fix, checking running kernel version with uname -a, checking whether the team module is loaded with lsmod | grep '^team', and checking for team interfaces with ip -d link show type team. Confirm remediation by booting into the updated kernel, verifying the installed kernel package includes the fix from the Linux vendor, and confirming no vulnerable kernel remains selected as the default boot entry. In controlled non-production testing, stress team mode changes while generating traffic and verify the system no longer produces kernel oops messages in team_xmit().

Typical attack path

1. Obtain local code execution on a Linux system with the network team driver available.
2. Gain or already possess CAP_NET_ADMIN or equivalent network administration capability, including through a privileged container or namespace configuration.
3. Create or identify a Linux team network device.
4. Trigger repeated team mode changes on the team device.
5. Concurrently generate outbound traffic through the team interface, for example using packet sockets or other high-rate local transmission paths.
6. Win the race where team_xmit() observes a NULL transmit handler during the mode-change window.
7. Cause a kernel NULL pointer dereference, resulting in a kernel oops, panic, reboot, or service disruption.

How to detect it

Look for evidence of kernel crashes or oops events involving the Linux team driver, especially around times when network team modes were changed. Relevant log sources include dmesg, journalctl -k, /var/log/kern.log, /var/log/messages, crash dump infrastructure such as kdump/vmcore, auditd logs for CAP_NET_ADMIN activity, container runtime logs for privileged or NET_ADMIN-enabled containers, and command history or EDR telemetry showing teamd, teamdctl, ip, or network configuration tools manipulating team interfaces. Correlate kernel oops signatures containing team_xmit(), dev_hard_start_xmit(), __dev_queue_xmit(), packet_sendmsg(), or drivers/net/team/team_core.c with nearby administrative events that change team mode. Because exploitation causes denial of service rather than persistent compromise, durable IOCs are primarily crash signatures, audit events, and suspicious repeated mode-change activity rather than files or backdoors.

• BUG: kernel NULL pointer dereference, address: 0000000000000000
• Oops: 0010
• RIP: 0010:0x0
• team_xmit
• drivers/net/team/team_core.c:1853
• dev_hard_start_xmit
• __dev_queue_xmit
• packet_sendmsg
• af_packet.c:3109
• __team_change_mode
• team_adjust_ops
• team->ops.transmit
• CAP_NET_ADMIN
• teamdctl
• teamd
• ip link set

What your security team should do

• Prioritize patching Linux systems that use network team devices, host containers, or grant CAP_NET_ADMIN to workloads or users.
• Inventory hosts with the team kernel module loaded or configured team interfaces.
• Restrict CAP_NET_ADMIN and privileged container usage to the smallest possible trusted set.
• Monitor kernel logs for NULL pointer dereferences involving team_xmit or drivers/net/team/team_core.c.
• If team networking is not required, disable or blacklist the team driver as a compensating control.
• Coordinate kernel updates with reboot planning, because remediation requires running the fixed kernel, not merely installing the package.
• Treat unexpected crashes on hosts using Linux team networking as potentially security-relevant until kernel logs and audit records are reviewed.