CVE-2026-64190

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: team: fix NULL pointer dereference in team_xmit during mode change<br /> <br /> __team_change_mode() clears team-&gt;ops with memset() before restoring<br /> safe dummy handlers via team_adjust_ops(). A concurrent team_xmit()<br /> running under RCU on another CPU can read team-&gt;ops.transmit during<br /> this window and call a NULL function pointer, crashing the kernel.<br /> <br /> The race requires a mode change (CAP_NET_ADMIN) concurrent with<br /> transmit on the team device.<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000000<br /> Oops: 0010 [#1] SMP KASAN NOPTI<br /> RIP: 0010:0x0<br /> Call Trace:<br /> team_xmit (drivers/net/team/team_core.c:1853)<br /> dev_hard_start_xmit (net/core/dev.c:3904)<br /> __dev_queue_xmit (net/core/dev.c:4871)<br /> packet_sendmsg (net/packet/af_packet.c:3109)<br /> __sys_sendto (net/socket.c:2265)<br /> <br /> The original code assumed that no ports means no traffic, so mode<br /> changes could freely memset()/memcpy() the ops. AF_PACKET with<br /> forced carrier breaks that assumption.<br /> <br /> Prevent the race instead of making it safe: replace memset()/memcpy()<br /> with per-field updates that never touch transmit or receive. Those<br /> two handlers are managed solely by team_adjust_ops(), which already<br /> installs dummies when tx_en_port_count == 0 (always true during mode<br /> change since no ports are present). WRITE_ONCE/READ_ONCE prevent<br /> store/load tearing on the handler pointers.<br /> <br /> synchronize_net() before exit_op() drains in-flight readers that may<br /> still reference old mode state from before port removal switched the<br /> handlers to dummies.