OVSwrap Linux Kernel Vulnerability Grants Root Access via Netlink Parsing Flaw
A critical vulnerability in the Linux kernel's Open vSwitch component, CVE-2026-64531 (OVSwrap), allows unprivileged local users to escalate privileges to root.
A newly disclosed Linux kernel vulnerability, tracked as CVE-2026-64531 and dubbed OVSwrap, allows unprivileged local users to escalate privileges to root on a wide range of popular Linux distributions. The flaw resides within the Open vSwitch (OVS) kernel datapath, a networking component frequently employed in cloud, container, and virtualization platforms. Researchers utilized an experimental approach combining large language models with structured memory-geometry visualizations to identify the complex kernel memory bug.
Open vSwitch processes network "actions" from userspace, converting them into an internal format stored using Netlink attributes. Each attribute has a length field limited to 16 bits. While the kernel permits the overall action stream to exceed 64 KiB, it previously failed to validate that individual nested actions, such as a CLONE action containing multiple small conntrack actions, adhered to the same 16-bit limit. This oversight is the core of the OVSwrap vulnerability.
When an attacker crafts an action that surpasses the 65,535-byte boundary, the stored length value erroneously wraps around to a small number. Subsequent kernel code, trusting this corrupted value, continues parsing from the middle of attacker-controlled data rather than the actual end of the action. This misinterpretation causes the parser to treat forged data as legitimate new actions, leading to arbitrary code execution.
The exploitability of OVSwrap is significantly amplified by its simplicity. Exploitation requires no special privileges, no pre-existing OVS bridge, no running switch daemon, and no host-level administrative rights. An ordinary local user can create an unprivileged user and network namespace using commands like unshare -Urn. Within this isolated namespace, they can gain CAP_NET_ADMIN privileges and initiate a private OVS datapath to trigger the vulnerable code path.
Alarmingly, the attack surface is present even on systems where OVS was not intentionally installed or started. This is because most distributions include OVS as a loadable kernel module that auto-loads on demand. The same exploitation technique could potentially be adapted for container escape scenarios, further broadening its impact.
Security researchers confirmed the vulnerability's exploitability in default configurations across a vast array of Linux distributions. Affected systems include AlmaLinux, Debian, Fedora, Ubuntu, Rocky Linux, Arch Linux, openSUSE Tumbleweed, Amazon Linux, Kali Linux, NixOS, and Linux Mint, among others. While some systems might require minor configuration adjustments, older kernel branches that did not receive a specific 2025 update remain unaffected.
The underlying vulnerable code had been present in the kernel for approximately thirteen years. It only became practically exploitable after a previous size limitation was removed in the preceding year. The issue was responsibly disclosed to the kernel security team and OVS maintainers, resulting in fixes being integrated into stable kernel releases, including versions 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5.
Administrators unable to apply immediate kernel patches are advised to consider mitigating the risk by blacklisting the openvswitch module if it is not essential, disabling unprivileged user namespaces where feasible, or implementing the emergency BPF-based mitigation that was released alongside the proof-of-concept exploit. Upgrading affected kernels to the patched versions remains the most robust and recommended defense against this critical vulnerability.
This new report provides a deeper technical dive into the OVSwrap vulnerability (CVE-2026-64531), detailing how a March 2025 change that removed a 32 KiB cap on generated Open vSwitch actions exposed a 13-year-old truncation bug. It further elaborates on the exploit chain, which uses a kernel pointer leak, arbitrary kernel read, and targeted decrement to modify kernel credentials and achieve root access, requiring specific conntrack support and the FTP conntrack helper.