A newly disclosed Linux kernel vulnerability dubbed OVSwrap gives unprivileged local users a reliable path to root on systems using the Open vSwitch (OVS) datapath.[8][5][9] Tracked as CVE-2026-64531, the flaw was publicly detailed by security researcher Asim Manizada on July 28, 2026, along with a proof-of-concept exploit.[5][8][11] A widely circulated exploit bundle ships with pre-built symbol records for roughly 800 kernel builds, underscoring how easily the bug can be weaponized across varied environments.[8][11] Some reports describe the issue with a provisional CVSS v3.1 score of 7.8, while the National Vulnerability Database entry for CVE-2026-64531 has yet to publish an official rating.[1][7][8]
OVSwrap stems from a memory corruption flaw in how the kernel’s Open vSwitch subsystem stores and parses nested flow actions as Netlink attributes in the datapath.[3][10][11] When userspace-supplied OVS actions are expanded, a generated nested action can exceed the 16‑bit nla_len field, causing the length to wrap and later parsers to trust attacker‑controlled bytes as valid instructions.[1][3][11] The bug became reachable after commit a1e64addf3ff removed a guard on misbehaving action lengths, and was later fixed by commit 3f1f75536668 (net: openvswitch: reject oversized nested action attrs) in upstream stable trees.[2][10][11] In practice, a local attacker who can manipulate an OVS-connected network namespace can craft oversized nested action attributes, leak kernel pointers, read arbitrary kernel memory and ultimately corrupt credential structures to gain root.[2][3][9]
Researchers say the flaw is exploitable on a broad set of stock kernels shipped by mainstream distributions, including Ubuntu 22.04 and 24.04, Debian 12 and 13, Fedora 42–44, Arch Linux, AlmaLinux, Rocky Linux, NixOS and Kali Linux.[5][8][9] Analysis of upstream releases indicates affected ranges spanning Linux 5.15.180–5.15.211, 6.1.132–6.1.177, 6.6.84–6.6.144, 6.12.20–6.12.96, and 6.18.0–6.18.39, plus several entirely affected series such as 6.14.y–6.17.y, 6.19.y and 7.0.y.[2][8][11] Crucially, reports emphasize that the OVS kernel module only needs to be present and loadable, not actively configured for switching, and that systems enabling unprivileged user namespaces are particularly exposed.[1][5][12] Advisories describe the bug as a local privilege escalation rather than a remote exploit, and note that there is currently no confirmed evidence of exploitation in the wild.[3][5][12]
Manizada’s technical write‑up on OVSwrap outlines how an attacker can abuse conntrack labels and timeout names to forge actions, steer parser behavior, and eventually overwrite targeted kernel data such as process credentials or sudoers configuration.[9][11] A demonstration released alongside the disclosure shows an unprivileged user running a script and obtaining full root access on a vulnerable host in under a second.[4][8] Security bulletins warn that containerized and multi‑tenant environments are at particular risk, because unprivileged users or workloads often receive their own network namespaces and can reach the OVS datapath even when the host is not explicitly using Open vSwitch for production traffic.[2][3][5]
Fixes for OVSwrap have landed in upstream Linux as part of the stable releases 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40 and 7.1.5, which incorporate the nested‑action length check in the OVS datapath.[2][8][11] Downstream vendors have begun shipping patched kernels, with distributions such as CloudLinux 9 and 10 and Rocky Linux 9 and 10 issuing guidance and updated packages that address CVE-2026-64531.[1][14][15] Advisories generally recommend upgrading to a fixed kernel where available, or temporarily unloading or blacklisting the openvswitch module, disabling unprivileged user namespaces, or applying emergency eBPF‑based mitigations on hosts that cannot be patched immediately.[1][3][9]
Security teams are urged to inventory systems for vulnerable kernel versions and enabled OVS datapath support, prioritize patching hosts that expose user or network namespaces to untrusted code, and monitor for unusual attempts to load the openvswitch module or manipulate conntrack helpers.[2][3][9] Given the availability of high‑quality public exploits and the relative simplicity of the attack path, OVSwrap is expected to become a favorite target for local privilege escalation in Linux environments unless organizations move quickly to remediate.[4][8][12]
References
- OVSwrap (CVE-2026-64531) local root exploit
- OVSwrap (CVE-2026-64531): Linux kernel/OVS local root …
- OSG-SEC-2026-07-29 OVSwrap kernel net openvswitch …
- CVE-2026-64531 & CVE-2026-53264: Two Linux Privilege …
- Linux Kernel Privilege Escalation to Root Vulnerability
- CVE-2026-64531 Detail – NVD
- New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch
- OVSwrap Linux Kernel Open vSwitch Flaw Enables Local Root Access | Mallory
- NVD
- OVSwrap: another Linux local root vulnerability
- New Linux Vulnerability CVE-2026-64531 Exposes Root Access Risks
- Mitigating OVSwrap (CVE-2026-64531) on Rocky Linux 9 and 10
- OVSwrap (CVE-2026-64531) already fixed in security …
