VulnerabilityPublished 20 Jul 2026Updated 21 Oct 2026

CVE-2026-64190: Linux kernel · net: team: fix NULL pointer dereference in team_xmit during mode change

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in cde5c7f0286c4203d0abc7248201542aa8bf33bb : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:07 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.1% chance of exploitation in 30 days – higher than 1% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in cde5c7f0286c4203d0abc7248201542aa8bf33bb, 9486377e5e971988a3add171c398eb654a866fab, 25fe708bbc59289d3d1ea4b126fbc1b460a072a5 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 20 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to cde5c7f0286c4203d0abc7248201542aa8bf33bb, 9486377e5e971988a3add171c398eb654a866fab, 25fe708bbc59289d3d1ea4b126fbc1b460a072a5 or 03e9405c518c4d61f28079492f252d6d4e2bac5c.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80, < cde5c7f0286c4203d0abc7248201542aa8bf33bb	Fixed in cde5c7f0286c4203d0abc7248201542aa8bf33bb
LinuxLinux	Affected ≥ 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80, < 9486377e5e971988a3add171c398eb654a866fab	Fixed in 9486377e5e971988a3add171c398eb654a866fab
LinuxLinux	Affected ≥ 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80, < 25fe708bbc59289d3d1ea4b126fbc1b460a072a5	Fixed in 25fe708bbc59289d3d1ea4b126fbc1b460a072a5
LinuxLinux	Affected ≥ 3d249d4ca7d0ed6629a135ea1ea21c72286c0d80, < 03e9405c518c4d61f28079492f252d6d4e2bac5c	Fixed in 03e9405c518c4d61f28079492f252d6d4e2bac5c
LinuxLinux	Affected =3.3	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: net: team: fix NULL pointer dereference in team_xmit during mode change __team_change_mode() clears team->ops with memset() before restoring safe dummy handlers via team_adjust_ops(). A concurrent team_xmit() running under RCU on another CPU can read team->ops.transmit during this window and call a NULL function pointer, crashing the kernel. The race requires a mode change (CAP_NET_ADMIN) concurrent with transmit on the team device. BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: 0010 [#1] SMP KASAN NOPTI RIP: 0010:0x0 Call Trace: team_xmit (drivers/net/team/team_core.c:1853) dev_hard_start_xmit (net/core/dev.c:3904) __dev_queue_xmit (net/core/dev.c:4871) packet_sendmsg (net/packet/af_packet.c:3109) __sys_sendto (net/socket.c:2265) The original code assumed that no ports means no traffic, so mode changes could freely memset()/memcpy() the ops. AF_PACKET with forced carrier breaks that assumption. Prevent the race instead of making it safe: replace memset()/memcpy() with per-field updates that never touch transmit or receive. Those two handlers are managed solely by team_adjust_ops(), which already installs dummies when tx_en_port_count == 0 (always true during mode change since no ports are present). WRITE_ONCE/READ_ONCE prevent store/load tearing on the handler pointers. synchronize_net() before exit_op() drains in-flight readers that may still reference old mode state from before port removal switched the handlers to dummies.

References

Community reviews

Loading reviews…