Linux Kernel Flaw OVSwrap Grants Root Access, Public Exploit Available
This digest was compiled by AI from multiple sources — links to the originals are below.
Security researcher Asim Manizada disclosed a local privilege escalation vulnerability in the Linux kernel's Open vSwitch datapath on July 28, 2026. Tracked as CVE-2026-64531 and codenamed OVSwrap, the flaw allows unprivileged users to gain root access on many default-configured distributions. A public exploit targeting approximately 800 kernel builds was released alongside the disclosure.
The Vulnerability
OVSwrap resides in the kernel's Open vSwitch datapath, not the userspace ovs-vswitchd daemon. Attackers can exploit it without an existing OVS bridge, a running ovs-vswitchd, or host-level CAP_NET_ADMIN. On systems where the OVS kernel module is available and unprivileged user namespaces are enabled, an attacker can create private user and network namespaces, gain CAP_NET_ADMIN inside, and trigger the bug via a specially crafted flow installation. The unsafe assignment persisted for 13 years, but a 32 KiB cap on the total action stream kept nested actions below the critical 65,535-byte boundary until it was removed in March 2025. The removal, intended to fix reliability issues in large OpenStack deployments, unintentionally exposed the truncation bug.
Exploitation and Impact
The public exploit uses a CLONE action packed with hundreds of conntrack sub-actions; on x86-64, the kernel expands each to 164 bytes, overflowing the 16-bit length field and corrupting memory. Because the overflow lands deterministically inside the same buffer, exploitation requires no heap grooming and succeeds with 'logic-bug-grade reliability,' according to Asim Manizada. The exploit ships with pre-built records for roughly 800 kernel builds and works in default configurations of many major Linux distributions. The vulnerability has a CVSS score of 7.8.
Mitigation and Patching
Upstream fixes shipped on July 24 in stable kernels Linux 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. The end-of-life kernel series 6.13 through 6.17, 6.19, and 7.0 will not receive upstream fixes. Unpatched systems can mitigate by preventing the openvswitch module from loading or unloading it if already resident; however, attempts to resolve its Generic Netlink family name can load the module automatically. Distribution vendors may have backported patches differently, so users should consult their vendor's security tracker rather than relying solely on upstream version numbers.
What's Next
Linux distribution vendors are expected to release kernel updates incorporating the fix, but timing varies widely across distributions. It remains unclear how many internet-facing or cloud systems running unpatched kernels are at immediate risk from the public exploit.
2 sources
Linux Kernel Flaw OVSwrap Grants Root Access, Public Exploit Available
