PT-2026-61643 · Linux · Linux
CVE-2026-64190
·
Published
2026-07-20
·
Updated
2026-07-20
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
net: team: fix NULL pointer dereference in team xmit during mode change
team change mode() clears team->ops with memset() before restoring
safe dummy handlers via team adjust ops(). A concurrent team xmit()
running under RCU on another CPU can read team->ops.transmit during
this window and call a NULL function pointer, crashing the kernel.
The race requires a mode change (CAP NET ADMIN) concurrent with
transmit on the team device.
BUG: kernel NULL pointer dereference, address: 0000000000000000
Oops: 0010 [#1] SMP KASAN NOPTI
RIP: 0010:0x0
Call Trace:
team xmit (drivers/net/team/team core.c:1853)
dev hard start xmit (net/core/dev.c:3904)
dev queue xmit (net/core/dev.c:4871)
packet sendmsg (net/packet/af packet.c:3109)
sys sendto (net/socket.c:2265)
The original code assumed that no ports means no traffic, so mode
changes could freely memset()/memcpy() the ops. AF PACKET with
forced carrier breaks that assumption.
Prevent the race instead of making it safe: replace memset()/memcpy()
with per-field updates that never touch transmit or receive. Those
two handlers are managed solely by team adjust ops(), which already
installs dummies when tx en port count == 0 (always true during mode
change since no ports are present). WRITE ONCE/READ ONCE prevent
store/load tearing on the handler pointers.
synchronize net() before exit op() drains in-flight readers that may
still reference old mode state from before port removal switched the
handlers to dummies.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux