Linux Kernel CVE-2026-64190

Exploitation requires: (1) a team network device (CONFIG_NET_TEAM) configured and active on the target system; (2) the attacker holds CAP_NET_ADMIN - either as root, via a capability grant, or within a user namespace where that capability is available (e.g., privileged Kubernetes pods or Docker containers with --cap-add NET_ADMIN); (3) an AF_PACKET socket with forced carrier on the team device to sustain traffic during the mode change, bypassing the prior assumption that no ports means no traffic; (4) timing the RTNETLINK mode-change operation to coincide with concurrent team_xmit() execution on another CPU. Exploitation is NOT possible from unprivileged remote network positions. Impact is limited to availability (kernel panic/reboot) - no data exfiltration or privilege escalation has been demonstrated. Non-default configuration required: the team driver must be loaded, a team interface created, and CAP_NET_ADMIN must be accessible to the attacker.

The official CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N) accurately reflects the local-only, availability-only impact, though AC:L undersells the race-condition timing requirement. EPSS at 0.14% (4th percentile) signals minimal real-world exploitation activity, consistent with the absence of a KEV listing. Practically, the prerequisite of holding CAP_NET_ADMIN - not a default grant for unprivileged users on traditional systems - limits opportunistic exploitation, although containerized environments that grant CAP_NET_ADMIN to workload users meaningfully expand the attack surface; even a mid-sized municipal IT operation in zabrze running Kubernetes with broad capability grants should treat this as a patching priority rather than a deferred item. No POC code has been identified. The risk profile is: locally exploitable, requires elevated capability, results in kernel panic, and is reproducible only under a narrow race window - low immediate priority on hardened hosts but should be patched in the normal kernel update cycle.

An attacker with a local shell and CAP_NET_ADMIN on a host or container using a team network interface opens an AF_PACKET socket with forced carrier on the team device, then triggers a mode change via rtnetlink while simultaneously flooding packets through the socket. The race between __team_change_mode()'s memset() zeroing the ops table and team_xmit() reading ops.transmit on a second CPU causes a branch to address 0x0, producing an immediate kernel NULL pointer dereference oops and system crash. No public exploit code has been identified, but the call trace in the CVE description provides sufficient implementation guidance.