A memory corruption flaw in the Linux kernel's Open vSwitch datapath gives ordinary local users a path to root on a broad set of default-configured distributions. A public exploit ships with pre-built records for roughly 800 kernel builds.
The vulnerability, tracked as CVE-2026-64531 and codenamed OVSwrap by its discoverer, was disclosed by security researcher Asim Manizada on July 28, 2026. The Linux kernel OVSwrap vulnerability carries a CVSS score of 7.8.
The bug sits in the kernel datapath, not the userspace ovs-vswitchd daemon. In a technical write-up, Manizada said an attacker needs "no existing OVS bridge, no running ovs-vswitchd, no host-level CAP_NET_ADMIN."
Let me walk through how the Linux kernel OVSwrap vulnerability works, which systems are affected, and what administrators need to do.
How the Linux Kernel OVSwrap Vulnerability Works
The Linux kernel OVSwrap vulnerability is a memory corruption flaw in Open vSwitch. On affected systems where the OVS kernel datapath is available and unprivileged user namespaces are enabled, an ordinary user can create private user and network namespaces with unshare -Urn, gain CAP_NET_ADMIN inside that namespace, and reach the vulnerable flow-installation path.
If the openvswitch module is installed but not loaded, resolving its Generic Netlink family name can load it automatically. An empty lsmod output does not mean a system is safe. The module can be loaded on demand.
The vulnerability stems from an unsafe assignment that had existed for 13 years. Open vSwitch stores generated flow actions as Netlink attributes whose nla_len field is 16 bits wide, capping any single nested attribute at 65,535 bytes. A 32 KiB cap on the total generated action stream kept a nested action below the wrap point.
A March 2025 change removed that cap because it produced unpredictable failures, including in large OpenStack deployments. The change exposed the older truncation bug. The enabling commit's review thread discussed reliability and user-facing failures but did not address the security consequence of removing the guard.
The Exploit Chain
The Linux kernel OVSwrap vulnerability exploit submits a CLONE action packed with hundreds of conntrack sub-actions. On x86-64, the kernel expands each one to 164 bytes, pushing the generated nested action past 65,535 bytes. When OVS writes the result into the 16-bit length field, the value wraps.
Later code trusts that length and resumes parsing from inside attacker-controlled conntrack data, where forged OVS actions are waiting. Because the landing point is deterministic inside the same contiguous buffer, no heap grooming is required. Manizada described the result as a memory corruption vulnerability with "logic-bug-grade reliability."
The exploit chains three primitives from the wraparound:
- A kernel pointer leak through a fake OUTPUT action
- An arbitrary kernel read through a forged tunnel SET action
- A targeted decrement through teardown of a forged tun_dst pointer
It uses those primitives to find a host process's credentials and, on modern kernels, decrement fsuid and fsgid to zero. On success, it corrupts a live kernel credential, modifies /etc/sudoers.d or /etc/sudoers, opens a root shell, and leaves processes and OVS state behind to avoid unsafe teardown.
The Public Exploit
The released proof-of-concept for the Linux kernel OVSwrap vulnerability is explicitly destructive. It requires OVS conntrack support, the FTP conntrack helper, and sudo to be installed. The PoC repository includes records for roughly 800 exact x86-64 kernel builds and attempts dynamic derivation from symbols or BTF for uncovered builds.
The exploit's broad coverage makes the Linux kernel OVSwrap vulnerability particularly concerning. Pre-built records for 800 kernel builds mean that many systems can be compromised without the attacker needing to customize the exploit.
Which Distributions Are Affected?
Manizada's non-exhaustive test matrix found default-config exploitation on a wide range of distributions.
The Linux kernel OVSwrap vulnerability affects:
- AlmaLinux 9 and 10
- Alpine 3.22 through 3.24
- Amazon Linux 2023
- Arch
- CentOS Stream 9 and 10
- Debian 12 and 13
- Fedora 42 through 44
- Gentoo
- Kali 2026.1
- Linux Mint 22.3
- NixOS
- openSUSE Tumbleweed
- Pop!_OS
- Rocky Linux 9 and 10
- Ubuntu 22.04
On tested Ubuntu 24.04 systems, AppArmor blocked direct namespace creation. But the PoC's aa-exec -p trinity fallback restored reachability. Stock Ubuntu 26.04 blocked the ordinary-user route; disabling its AppArmor user-namespace restriction made the tested systems exploitable.
Tested Amazon Linux 2, Debian 11, Rocky Linux 8, and Ubuntu 20.04 retained older code paths and were not exploitable through this route.
The Fixed Versions
Manizada reported the issue to [email protected] and the OVS maintainers on June 19.
The first fixed upstream releases are:
- Linux 5.15.212
- Linux 6.1.178
- Linux 6.6.145
- Linux 6.12.97
- Linux 6.18.40
- Linux 7.1.5
The end-of-life 6.13 through 6.17, 6.19, and 7.0 series will not receive upstream stable fixes. Those upstream numbers are not enough on their own. Distribution kernels carry backports and downstream changes, so the vendor tracker is the safer source of truth.
What Administrators Should Do
Where a patched vendor kernel is not yet available for the Linux kernel OVSwrap vulnerability, and Open vSwitch is not required, block future module loads. If the module is already resident, unload it or reboot.
The fastest interim step is a module block:
echo 'install openvswitch /bin/false' >
/etc/modprobe.d/ovswrap.confThe override blocks future module-load attempts. A module already resident in memory must still be removed or cleared by rebooting.
Disabling unprivileged user namespaces closes the ordinary local-user route but does not block a container or other process that already has CAP_NET_ADMIN over an attacker-controlled network namespace. Manizada described the container direction as theoretically reachable but did not demonstrate it in the released PoC.
The PoC repository also includes an emergency BPF guard for environments that must keep both OVS and namespaces active.
The Risk Profile
The Linux kernel OVSwrap vulnerability is especially acute where multiple users or untrusted workloads share a host. As CloudLinux's advisory put it, the local user in that scenario may be an attacker who already compromised one site through an unrelated flaw, and OVSwrap is what turns that single-account problem into a whole-server one.
This is a critical distinction. The Linux kernel OVSwrap vulnerability is not a remote attack. But in shared hosting environments, a compromised user account can become full root access.
The Timeline
The Linux kernel OVSwrap vulnerability has a notable timeline. The unsafe assignment existed for 13 years. The enabling commit that removed the cap was made in March 2025. The vulnerability was disclosed on July 28, 2026.
The upstream fix shipped in stable trees on July 24. This means the fix was available before the public disclosure. Administrators who applied updates promptly may already be protected.
Wrapping It Up
The Linux kernel OVSwrap vulnerability is a serious local privilege escalation flaw affecting a broad range of distributions. CVE-2026-64531 allows ordinary local users to gain root access on systems with the Open vSwitch kernel datapath available and unprivileged user namespaces enabled.
A public exploit ships with pre-built records for roughly 800 kernel builds. The exploit is reliable and has been tested on many common distributions.
Administrators should patch immediately. If a patched kernel is not available, block the openvswitch module or disable unprivileged user namespaces.For shared hosting environments, please consider this an important matter.
Linux kernel OVSwrap vulnerability is yet another example of how dangerous local privilege escalation vulnerabilities can be. Patch, protect and be on guard.
FAQ Section
What is the Linux kernel OVSwrap vulnerability?
CVE-2026-64531 is a memory corruption flaw in the Open vSwitch kernel datapath that allows ordinary local users to gain root privileges on affected systems.
How does the vulnerability work?
The attacker submits a CLONE action with many conntrack actions and the Netlink attribute length wraps around more than 65,535 bytes. Later code trusts the wrapped length and parses attacker-controlled data, enabling memory corruption and privilege escalation.
Which distributions are affected?
Most modern distributions are affected including AlmaLinux, Alpine, Amazon Linux 2023, Arch, CentOS Stream, Debian 12/13, Fedora, Kali, Linux Mint, openSUSE, Rocky Linux, and Ubuntu 22.04. Ubuntu 24.04 is exploitable with a fallback; Ubuntu 26.04 is exploitable only if AppArmor restrictions are disabled.
How can I protect against this vulnerability?
Patch to a fixed upstream kernel version. If unavailable, block the openvswitch module with echo 'install openvswitch /bin/false' > /etc/modprobe.d/ovswrap.conf and reboot or unload the module.
Is the vulnerability exploited in the wild?
A public proof-of-concept exists with pre-built records for roughly 800 kernel builds. No widespread exploitation has been confirmed, but the public exploit makes exploitation likely.
