New OVSwrap Linux Vulnerability Lets Attackers Gain Root Access

A newly disclosed Linux kernel vulnerability, tracked as CVE-2026-64531 and dubbed OVSwrap, allows unprivileged local users to escalate privileges to root on a wide range of popular Linux distributions.

The flaw lives inside the Open vSwitch (OVS) kernel datapath, a networking component widely used in cloud, container, and virtualization platforms, and was uncovered using an experimental research approach by Asim Viladi Oglu Manizada that pairs large language models with structured memory-geometry visualizations to reason through complex kernel memory bugs.

Open vSwitch takes a list of network “actions” from userspace and rewrites them into an internal format stored using Netlink attributes, each of which has a length field limited to just 16 bits.

While the kernel permits the overall action stream to exceed 64 KiB, it previously failed to check whether an individual nested action, such as a CLONE wrapping many small conntrack actions, stayed under that same 16-bit ceiling.

OVSwrap Linux Vulnerability

When an attacker crafts an action large enough to cross the 65,535-byte boundary, the stored length value silently wraps around to a small number. Later kernel code trusts that wrapped value and resumes parsing from the middle of attacker-controlled data instead of the true end of the action, effectively confusing the parser into treating forged data as legitimate new actions.

Because conntrack fields like labels and timeout names are attacker-controlled, and the wraparound lands at a predictable offset once the kernel build is known, exploitation requires no memory grooming at all, making it behave more like a reliable logic bug than a typical, fragile memory-corruption issue.

Alarmingly, exploitation does not require any pre-existing OVS bridge, a running switch daemon, or host-level administrative rights. An ordinary local user can simply create an unprivileged user and network namespace with a command like unshare -Urn, gain CAP_NET_ADMIN within that isolated namespace, and spin up a private OVS datapath to reach the vulnerable code path.

Since most distributions ship OVS as a loadable kernel module that auto-loads on demand, the attack surface is present even on systems where OVS was never intentionally installed or started, and the same technique could plausibly extend to container escape scenarios.

Security researchers found the bug exploitable in default configurations across a broad swath of the Linux ecosystem, including AlmaLinux, Debian, Fedora, Ubuntu, Rocky Linux, Arch Linux, openSUSE Tumbleweed, Amazon Linux, Kali Linux, NixOS, and Linux Mint, among others. Some systems require minor configuration tweaks to become exploitable, while older kernel branches that never received a related 2025 change remain unaffected.

The underlying unsafe code had existed in the kernel for roughly thirteen years but only became exploitable after an older size limit was removed last year.

The issue was responsibly disclosed to the kernel security team and OVS maintainers, with fixes landing in stable kernel releases including 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5.

Administrators unable to patch immediately are advised to blacklist the openvswitch module if it is not needed, disable unprivileged user namespaces where feasible, or deploy the emergency BPF-based mitigation released alongside the proof-of-concept. Given the availability of patches, upgrading affected kernels remains the most reliable defense.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.