OVSwrap: a Linux kernel flaw hands local users root through Open vSwitch

On July 28, 2026, security researcher Asim Manizada disclosed a Linux kernel vulnerability assigned the identifier CVE-2026-64531 (CVSS 7.8) and the code name OVSwrap. The flaw allows an unprivileged local user to escalate their privileges to root.

Where the bug hides

The problem lies not in the userspace daemon ovs-vswitchd but in the Open vSwitch datapath itself, inside the kernel. According to the author, the attack requires neither an existing OVS bridge, nor a running daemon, nor the CAP_NET_ADMIN privilege at the host level. If the OVS kernel module is available on the system and unprivileged namespaces are enabled, a user runs unshare -Urn to create their own namespaces, gains CAP_NET_ADMIN inside them, and reaches the vulnerable flow-installation code. Even an empty lsmod output is no guarantee of safety: a call to the Generic Netlink family can load the module automatically.

A thirteen-year-old bug that was woken up

OVS stores generated actions as Netlink attributes, where the 16-bit-wide nla_len length field caps a nested attribute at 65,535 bytes. The unsafe assignment existed for 13 years, but a 32 KiB limit on the total action flow kept the value below the overflow point. In March 2025 that limit was removed — it was causing unpredictable failures, including in large OpenStack deployments — and the old truncation bug came to light. The discussion around the change spoke of reliability, but not of the security implications.

The attacker sends a CLONE action with hundreds of conntrack sub-items; on x86-64 the kernel expands each to 164 bytes, and the total length overflows the 16-bit field. The subsequent code trusts the wrapped value and keeps parsing inside attacker-controlled data, where fake OVS actions have already been prepared. Manizada called the result a vulnerability with “logic-bug-grade reliability.”

Scale and defense

The published PoC includes entries for roughly 800 specific x86-64 kernel builds and is deliberately destructive: it corrupts kernel credentials, edits /etc/sudoers, and opens a root shell. In the author's test matrix, the following proved vulnerable in their default configuration: AlmaLinux 9 and 10, Alpine, Amazon Linux 2023, Arch, CentOS Stream, Debian 12 and 13, Fedora 42–44, Gentoo, Kali, Linux Mint, NixOS, openSUSE Tumbleweed, Rocky Linux, and Ubuntu 22.04. On Ubuntu 24.04 the path was blocked by AppArmor, but could be bypassed via aa-exec. Older systems such as Debian 11 and Ubuntu 20.04 were not affected.

The fix landed in the stable branches on July 24; the first fixed releases are 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. Where an updated kernel is not yet available and Open vSwitch is not needed, blocking the module from loading via /etc/modprobe.d is recommended. As CloudLinux notes, the situation is especially dangerous on shared hosts: OVSwrap turns the compromise of a single account into a takeover of the entire server.

Source: The Hacker News