OVSwrap flaw exposes Linux hosts to local root escalation
A memory-corruption flaw in the Linux kernel's Open vSwitch datapath can let an ordinary local user gain root on many default-configured distributions. CVE-2026-64531, codenamed OVSwrap by researcher Asim Manizada, carries a CVSS score of 7.8; its public proof of concept includes records for roughly 800 exact x86-64 kernel builds.
Manizada disclosed the issue on July 28, 2026, after reporting it to security@kernel.org and Open vSwitch maintainers on June 19. The upstream fix entered stable trees on July 24. The first corrected releases are Linux 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5.
Why an inactive OVS setup may still be exposed
The bug is in the kernel datapath, not the userspace ovs-vswitchd daemon. On systems with the OVS datapath available and unprivileged user namespaces enabled, a local user can create private user and network namespaces with unshare -Urn, obtain CAP_NET_ADMIN inside that namespace, and reach the vulnerable flow-installation path.
No existing OVS bridge, running ovs-vswitchd process, or host-level CAP_NET_ADMIN is required. Resolving the Generic Netlink family can automatically load an installed openvswitch module, so an empty lsmod result does not establish that a host is safe.
The issue adds a privilege-escalation route to the broader pattern of Linux rootkits, router zero-days, and AI attacks that matters when assessing Linux hosts exposed to local or workload-level compromise.
How the length wrap becomes memory corruption
Open vSwitch stores generated flow actions as Netlink attributes with a 16-bit nla_len field, limiting one nested attribute to 65,535 bytes. An unsafe assignment existed for 13 years, but a 32 KiB cap on the total generated action stream kept nested actions below the wrap point.
A March 2025 change removed that cap because it caused unpredictable failures, including in large OpenStack deployments. An attacker can now submit a CLONE action containing hundreds of conntrack sub-actions. On x86-64, each expands to 164 bytes, carrying the nested action beyond 65,535 bytes. The stored length wraps, and later parsing resumes inside attacker-controlled conntrack data.
The deterministic landing point requires no heap grooming. The exploit combines a kernel pointer leak, an arbitrary kernel read, and a targeted decrement to locate host credentials and, on modern kernels, reduce fsuid and fsgid to zero.
Exposure and immediate action
The released proof of concept is destructive and requires OVS conntrack support, the FTP conntrack helper, and sudo. On success, it corrupts a live credential, changes /etc/sudoers.d or /etc/sudoers, launches a root shell, and deliberately leaves processes and OVS state behind.
Manizada reproduced default-config exploitation across tested releases including AlmaLinux, Alpine, Amazon Linux 2023, Arch, CentOS Stream, Debian 12 and 13, Fedora, Rocky Linux, and Ubuntu 22.04. Stock Ubuntu 26.04 blocked the ordinary-user path. Tested Amazon Linux 2, Debian 11, Rocky Linux 8, and Ubuntu 20.04 were not exploitable through this route.
Organizations should install a patched vendor kernel and use the vendor tracker because distribution backports make upstream version comparisons insufficient. If Open vSwitch is unnecessary, block future loads with install openvswitch /bin/false in a modprobe configuration file; unload an already resident module or reboot. Disabling unprivileged user namespaces blocks the ordinary-user route, but not a process that already controls a network namespace with CAP_NET_ADMIN. Shared hosts with multiple users or untrusted workloads therefore warrant priority review and remediation.