Executive brief
A vulnerability in the Linux kernel's network 'teaming' driver can cause the system to hang or become unstable when network interfaces are removed or moved between namespaces. This component is responsible for grouping multiple network interfaces into a single logical interface for redundancy or increased throughput. An exploit could lead to a denial-of-service condition, impacting the availability of the affected server.
Technical details
A reference counting issue exists in the Linux kernel's team driver (drivers/net/team/team_core.c). When unregistering a slave interface, the driver triggers a NETDEV_CHANGEMTU event that incorrectly increments reference counts, preventing the network device from being fully freed. This leads to a 'waiting for netdev to become free' hang. The fix involves using __netif_set_mtu while holding the netdev instance lock to avoid unnecessary notifier chain events during unregistration. Patches are available for various stable kernel branches including 6.18.x and 6.19.x.
Affected products
- Linux Linux Kernel 3.3 to 6.18.16, 6.19 to 6.19.6, 7.0-rc1
Timeline
- 2026-02-24: patched: Initial patch authored by Tetsuo Handa
- 2026-05-06: advisory: CVE-2026-43234 published