OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch

A newly disclosed memory corruption vulnerability in the Linux kernel’s Open vSwitch (OVS) datapath, tracked as CVE-2026-64531 and codenamed OVSwrap, allows unprivileged local users to gain root privileges on a wide range of default-configured Linux distributions. The flaw was discovered by security researcher Asim Manizada and disclosed on July 28, 2026. It resides in the kernel datapath, not the userspace ovs-vswitchd daemon, and requires no existing OVS bridge, no running ovs-vswitchd, and no host-level CAP_NET_ADMIN.

The vulnerability stems from a 13-year-old unsafe assignment in the OVS flow action handling. A March 2025 change removed a 32 KiB cap on the generated action stream, exposing the bug. An attacker can submit a CLONE action with hundreds of conntrack sub-actions, causing the nested action to exceed the 65,535-byte limit of the 16-bit nla_len field. This wraps the length value, leading to memory corruption with what Manizada describes as “logic-bug-grade reliability.” The exploit chains three primitives: a kernel pointer leak, an arbitrary kernel read, and a targeted decrement, ultimately allowing the attacker to zero out fsuid and fsgid to gain root.

The released proof-of-concept is destructive and requires OVS conntrack support, the FTP conntrack helper, and sudo. It includes pre-built records for roughly 800 x86-64 kernel builds. Manizada’s testing found default-config exploitation on many distributions, including AlmaLinux, Alpine, Amazon Linux 2023, Arch, CentOS Stream, Debian, Fedora, Gentoo, Kali, Linux Mint, NixOS, openSUSE Tumbleweed, Pop!_OS, Rocky Linux, and Ubuntu. Some distributions with AppArmor restrictions, like Ubuntu 24.04, were still exploitable via a fallback. The upstream fix shipped in stable trees on July 24, with first fixed releases including Linux 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. Users are advised to install patched vendor kernels or block the openvswitch module if not needed.