The Linux kernel project disclosed CVE-2026-64190 on July 20, 2026, a vulnerability in the Team network driver that can bring down a system with a single misconfigured mode change. Admins running Linux workloads under WSL 2, Hyper‑V, or Azure should pay attention — a kernel crash on a virtualized host can disrupt multiple services at once.

What actually changed

The bug lives in drivers/net/team/team_core.c, the core of Linux’s Team interface bonding driver. When an administrator or privileged service changes the operating mode of a Team device, the driver historically cleared the entire operations structure with memset() and then wrote the new mode’s callbacks. During that tiny window, a concurrent CPU could be processing a transmit request and read a NULL function pointer where the transmit handler should be. The kernel jumps to address zero and dies — a classic NULL pointer dereference.

The root cause is a race condition with very specific triggering requirements:
- A Team interface must be undergoing a mode change (requires CAP_NET_ADMIN).
- Traffic must be transmitted through that same interface simultaneously.
- The most reliable trigger uses AF_PACKET sockets with forced carrier, which allows packet injection even when the Team interface has no active member ports.

The fix, available in upstream kernels 6.18.35 and 7.1, replaces the broad memset()/memcpy() with per‑field updates that never touch the transmit or receive handlers. Those handlers are now managed exclusively by team_adjust_ops(), which already installs safe dummy callbacks. Additionally, synchronize_net() ensures in‑flight readers drain before the old mode is torn down.

What it means for you

The direct impact is denial of service: a kernel panic or oops that stops the machine. There’s no evidence of code execution or data leakage, but a crash on a hypervisor host, storage gateway, or container node can cascade into broader outages.

For Windows desktop users: If you don’t run WSL 2 with custom Team interfaces, you’re unaffected. Native Windows NIC Teaming is not the same as the Linux Team driver.

For WSL 2 power users and developers: WSL 2 uses a real Linux kernel inside a lightweight VM. By default, networking is handled by a virtual switch; Team interfaces aren’t part of the standard experience. But if you’ve built custom kernels, enabled advanced networking, or imported enterprise Linux images that use Team bonding, verify your configuration. The risk is low for typical WSL use.

For admins of Linux VMs on Hyper‑V or Azure: Any Linux guest that actively uses Team interfaces is potentially vulnerable. The trigger requires a mode change, so automation tools (CI/CD orchestration, failover scripts, configuration management) that adjust Team runners on the fly increase the odds of hitting the race. Check your Linux distribution’s kernel security advisories for the backported patch.

For enterprise IT running mixed‑platform networks: Linux physical servers, appliances, and virtual appliances may have Team interfaces configured years ago and forgotten. An inventory of teamd‑managed devices and NetworkManager connections with Team profiles is a prudent step.

How we got here

The Team driver was introduced in Linux 3.3 as a more modular alternative to the bonding driver. Its architecture split control‑plane logic (often handled by userspace teamd) from the kernel fast path, which seemed cleaner but created a synchronization gap.

The original code assumed that if a Team interface has no active ports, no traffic could be transmitted. That held true for many ordinary network stacks — but AF_PACKET sockets, used by packet analyzers and network testing tools, can bypass that assumption. When an administrator forces carrier on an interface, the kernel can still enqueue packets for transmission even when no physical ports are up. This mismatch persisted unnoticed for over a decade, likely because manual mode changes on quiet interfaces rarely coincided with simultaneous AF_PACKET traffic. Automated environments, however, are fertile ground for such concurrency bugs.

The fix landed upstream after the kernel security team determined the crash could be triggered locally by a privileged user. Distributions will now backport the patch to their long‑term support kernels.

What to do now

  1. Inventory your Linux systems. Run these commands on each host to spot active Team interfaces:
    bash ip link show type team # list Team interfaces lsmod | grep team # check if the team module is loaded teamdctl config dump # show Teamd configuration if teamd is running
    Also examine /etc/network/interfaces, Netplan YAML files, or NetworkManager connection profiles for Team device definitions.

  2. Distinguish Team from bonding. Bonding interfaces (often named bond0) use the bonding driver and are not affected. Bridges, VLANs, and Open vSwitch are also unrelated.

  3. Check vendor kernel updates.
    - WSL 2: Update your distribution via apt upgrade (Ubuntu/Debian) or equivalent, then restart WSL with wsl --shutdown.
    - Azure Linux VMs: Use apt, yum, or zypper to install the latest kernel package from the distribution repository.
    - Hyper‑V guests: Follow the same distribution‑specific update process. A reboot is required after a kernel update.
    - Physical appliances: Consult the appliance vendor’s security advisory. Do not manually install upstream kernels on vendor‑locked appliances.

  4. Verify the fix. After updating, confirm the kernel version includes the fix:
    bash uname -r # For Debian/Ubuntu: grep -i cve-2026-64190 /usr/share/doc/linux-image-*/changelog.Debian.gz # For RHEL/CentOS: rpm -q --changelog kernel | grep CVE-2026-64190

  5. Test failover behavior. If Team interfaces are used for redundancy, perform a controlled mode change after the update to ensure the runner behaves correctly and no crashes occur.

  6. Review network‑admin privileges. The race requires CAP_NET_ADMIN. Audit containers, services, and automation agents that hold this capability and reduce it where possible. Restrict the ability to change Team modes to trusted personnel or tightly scoped automation.

Outlook

As of late July 2026, the NVD has not assigned a CVSS score, but that doesn’t diminish the importance of patching. Major distributions — Ubuntu, Red Hat, SUSE, Debian — are expected to release updated kernels within their regular security cadence. Watch for advisories that explicitly mention CVE‑2026‑64190 or the upstream commits 03e9405c and 25fe708b.

The broader lesson is that infrastructure availability can hinge on obscure driver concurrency. A mode change that looks like a quiet administrative task can still race with a packet, and a NULL callback can still panic the kernel. Keep your Linux kernels current, limit privileged network operations, and treat Team interfaces with the same vigilance you’d apply to any critical link‑aggregation layer.