Pierluigi Paganini
August 05, 2026
Security researcher Asim Manizada disclosed OVSwrap (CVE-2026-64531, CVSS score of 7.8), a local privilege escalation vulnerability in the Linux kernel’s Open vSwitch datapath that lets an ordinary user become root on a wide range of default-configured distributions.
The upstream fix shipped in stable trees on July 24, and a proof-of-concept exploit with pre-built records for roughly 800 kernel builds is now public. If your distribution hasn’t shipped a patched kernel yet, you need to act now.
“Open vSwitch accepts a list of “actions” from userspace and validates/rewrites some of the actions into a larger internal form. These internal actions are stored as Netlink attributes, whose length field is only 16 bits wide. Now, the total internal action stream is allowed to grow past 64 KiB. But an individual nested action attribute (an attribute and all of its recursive children) still needs to fit in that 16-bit length field. Pre-fix, Open vSwitch did not check that second limit.” reads the report published by Manizada. “As a result, an attacker can submit a valid action (e.g., CLONE) containing hundreds of, say, small conntrack actions.”
The unsafe assignment behind this had been in the code for 13 years without being exploitable, held in check by a 32 KiB cap on the total generated action stream. A March 2025 change removed that cap because it was causing unpredictable failures in large OpenStack deployments, and in doing so made the old bug reachable. The enabling commit’s review thread discussed reliability and user-facing failures but never addressed the security consequence of removing the guard.
“The kernel expands those actions until the generated action is larger than 65,535 bytes, then stores that length in the 16-bit nla_len, causing it to wrap to a small value. Later code trusts the wrapped length, advances by it, and resumes parsing from the middle of the generated conntrack data.
“Critically, parts of that conntrack data – labels and timeout names – are controlled by the attacker.” the researcher continues. “Parts of that conntrack data — labels and timeout names — are controlled by the attacker. And because the wraparound redirects parsing to a deterministic offset within the same contiguous buffer, forged action headers can be placed exactly where parsing resumes. No heap grooming needed, which is why Manizada describes it as having “logic-bug-grade reliability.” Memory corruption with the predictability of a logic bug is not something defenders encounter every day.”
The exploit chains three primitives from that wraparound: a kernel pointer leak through a fake OUTPUT action, an arbitrary kernel read through a forged tunnel SET action, and a targeted decrement through teardown of a forged tunnel destination pointer.
The proof-of-concept exploit uses leaked kernel information to locate critical memory structures, bypass kernel protections, and eventually change the attacker’s user and group IDs to zero, effectively granting root privileges.
The PoC corrupts a live kernel credential, modifies /etc/sudoers or /etc/sudoers.d, and opens a root shell, leaving processes and OVS state behind deliberately to avoid unsafe teardown.
The reachability conditions are what make this broadly dangerous.
“Importantly, the attacker does not need much to reach the vulnerable code – no existing OVS bridge, no running ovs-vswitchd, no host-level CAP_NET_ADMIN. All you need is a CAP_NET_ADMIN in the user namespace that owns the network namespace*.” continues the report. “An ordinary user can therefore use an unprivileged user namespace to create a new network namespace, receive CAP_NET_ADMIN over that namespace, and create a private OVS datapath inside it with a plain unshare -Urn. This leaves many distros vulnerable in their default unprivileged-user-namespaces-enabled configuration.”
The tested list of exploitable distributions in default configuration includes AlmaLinux 9 and 10, Alpine 3.22 through 3.24, Amazon Linux 2023, Arch, CentOS Stream 9 and 10, Debian 12 and 13, Fedora 42 through 44, Kali 2026.1, Linux Mint 22.3, NixOS, openSUSE Tumbleweed, Pop!_OS, Rocky Linux 9 and 10, and Ubuntu 22.04. Ubuntu 24.04 blocks direct namespace creation via AppArmor but falls to an aa-exec fallback in the PoC; Ubuntu 26.04 is blocked by default but exploitable after disabling AppArmor’s user-namespace restriction.
Install the patched vendor kernel if one is available. If you can’t patch today and OVS isn’t required on the system, the fastest interim step is to block future module loads with echo 'install openvswitch /bin/false' > /etc/modprobe.d/ovswrap.conf — though a module already loaded in memory still needs to be removed or cleared by rebooting. Disabling unprivileged user namespaces closes the ordinary local-user route but doesn’t protect against a container process that already has CAP_NET_ADMIN over a network namespace it controls. The PoC repository also includes an emergency BPF guard for environments that must keep both OVS and namespaces active.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Linux)
