CVE-2026-64190

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: team: fix NULL pointer dereference in team_xmit during mode change

__team_change_mode() clears team->ops with memset() before restoring

safe dummy handlers via team_adjust_ops(). A concurrent team_xmit()

running under RCU on another CPU can read team->ops.transmit during

this window and call a NULL function pointer, crashing the kernel.

The race requires a mode change (CAP_NET_ADMIN) concurrent with

transmit on the team device.

BUG: kernel NULL pointer dereference, address: 0000000000000000

Oops: 0010 [#1] SMP KASAN NOPTI

RIP: 0010:0x0

Call Trace:

team_xmit (drivers/net/team/team_core.c:1853)

dev_hard_start_xmit (net/core/dev.c:3904)

__dev_queue_xmit (net/core/dev.c:4871)

packet_sendmsg (net/packet/af_packet.c:3109)

__sys_sendto (net/socket.c:2265)

The original code assumed that no ports means no traffic, so mode

changes could freely memset()/memcpy() the ops. AF_PACKET with

forced carrier brea

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References