CVE-2026-64190 describes a vulnerability in the Linux kernel team network driver where a race condition during mode changes can cause a NULL pointer dereference in the team_xmit function. The vulnerability occurs because team_change_mode() clears the team->ops structure with memset() before restoring dummy handlers, but a concurrent team_xmit() running under RCU can read a NULL transmit function pointer, leading to a kernel crash. The root cause is the assumption that no ports means no traffic, which is broken by AF_PACKET with forced carrier. The fix prevents the race by updating operation pointers individually without touching transmit or receive handlers and uses synchronization to drain in-flight readers referencing old mode state.

Exploitation of this race condition can cause a kernel NULL pointer dereference, resulting in a kernel crash (Oops). This impacts system stability and availability but does not indicate privilege escalation or data compromise from the provided data.

A fix has been implemented in the Linux kernel to address this vulnerability by replacing unsafe memory operations with per-field updates and synchronization. Users should apply the official kernel updates that include this fix. Patch status is not explicitly stated in the provided data; therefore, check the vendor's advisory or Linux kernel mailing lists for the specific fixed versions and apply updates accordingly.