PT-2026-61643 · Linux · Linux
CVE-2026-64190
·
Publicado
2026-07-20
·
Atualizado
2026-07-20
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
net: team: fix NULL pointer dereference in team xmit during mode change
team change mode() clears team->ops with memset() before restoring
safe dummy handlers via team adjust ops(). A concurrent team xmit()
running under RCU on another CPU can read team->ops.transmit during
this window and call a NULL function pointer, crashing the kernel.
The race requires a mode change (CAP NET ADMIN) concurrent with
transmit on the team device.
BUG: kernel NULL pointer dereference, address: 0000000000000000
Oops: 0010 [#1] SMP KASAN NOPTI
RIP: 0010:0x0
Call Trace:
team xmit (drivers/net/team/team core.c:1853)
dev hard start xmit (net/core/dev.c:3904)
dev queue xmit (net/core/dev.c:4871)
packet sendmsg (net/packet/af packet.c:3109)
sys sendto (net/socket.c:2265)
The original code assumed that no ports means no traffic, so mode
changes could freely memset()/memcpy() the ops. AF PACKET with
forced carrier breaks that assumption.
Prevent the race instead of making it safe: replace memset()/memcpy()
with per-field updates that never touch transmit or receive. Those
two handlers are managed solely by team adjust ops(), which already
installs dummies when tx en port count == 0 (always true during mode
change since no ports are present). WRITE ONCE/READ ONCE prevent
store/load tearing on the handler pointers.
synchronize net() before exit op() drains in-flight readers that may
still reference old mode state from before port removal switched the
handlers to dummies.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux