Executive brief
A vulnerability in the Linux kernel's network teaming driver can cause a system crash. This occurs when a system administrator changes the operational mode of a teamed network interface while the interface is actively transmitting data. An exploit of this flaw results in a complete denial of service (system crash), impacting the availability of the server and any hosted services.
Technical details
A NULL pointer dereference exists in the Linux kernel's 'team' network driver within the 'team_xmit' function. The root cause is a race condition in '__team_change_mode()', which uses 'memset()' to clear operational handlers before installing new ones. A concurrent 'team_xmit()' execution on another CPU can read a NULL 'transmit' pointer during this window, leading to a kernel crash. Exploitation requires 'CAP_NET_ADMIN' privileges to trigger a mode change while traffic is being processed (e.g., via AF_PACKET). The issue has been resolved by replacing bulk memory operations with per-field updates and using 'synchronize_net()' to ensure in-flight readers complete before mode state is destroyed.
Affected products
- Linux Linux Kernel 3.3 to 6.18.35
Timeline
- 2026-05-21: other: Vulnerability fixed in upstream commits
- 2026-07-20: disclosed: CVE published