A newly disclosed Linux kernel vulnerability named OVSwrap is exposing a wide range of Linux distributions to local privilege escalation attacks through the Open vSwitch kernel datapath. Tracked as CVE 2026 64531 and assigned a CVSS score of 7.8, the flaw allows ordinary local users to obtain root privileges on affected systems under specific conditions. Security researcher Asim Manizada disclosed the vulnerability on July 28, 2026, explaining that the issue exists within the Linux kernel Open vSwitch datapath rather than the userspace ovs v switchd daemon. According to the researcher, attackers do not require an existing Open vSwitch bridge, a running ovs v switchd service, or host level CAP NET ADMIN privileges to exploit the flaw. A public proof of concept has also been released, including prebuilt records for approximately 800 x86 64 kernel builds, increasing the importance of applying available security updates.
The vulnerability affects systems where the Open vSwitch kernel datapath is available and unprivileged user namespaces are enabled. Under these conditions, an ordinary user can create private user and network namespaces using unshare, obtain CAP NET ADMIN privileges within the new namespace, and access the vulnerable flow installation path. Researchers noted that even if the Open vSwitch module is installed but not currently loaded, resolving its Generic Netlink family name may automatically load the module, meaning an empty module list should not be considered evidence that a system is protected. The flaw originates from the way Open vSwitch stores generated flow actions as Netlink attributes with a sixteen bit length field. Although the underlying assignment issue had existed for more than thirteen years, it remained protected by a thirty two kilobyte limit on generated action streams. That safeguard was removed in March 2025 to resolve reliability issues affecting large OpenStack deployments, unintentionally exposing the older memory corruption bug. By submitting specially crafted CLONE actions containing numerous connection tracking subactions, attackers can trigger a length wraparound that causes the kernel to interpret attacker controlled data as legitimate Open vSwitch actions, enabling reliable memory corruption without complex heap manipulation.
According to the published technical analysis, the exploit combines several techniques following the wraparound condition, including a kernel pointer leak, arbitrary kernel memory reading, and targeted modification of kernel credential structures. These capabilities allow attackers to locate process credentials and modify file system user identifiers until root level privileges are obtained. The proof of concept is described as intentionally destructive because it alters live kernel credentials, modifies sudo configuration files, launches a root shell, and intentionally leaves processes and Open vSwitch state active to avoid unsafe cleanup. The exploit also requires Open vSwitch connection tracking support, the FTP connection tracking helper, and sudo to be installed. Testing conducted by the researcher demonstrated successful exploitation on a broad range of default configured Linux distributions, including AlmaLinux 9 and 10, Alpine Linux versions 3.22 through 3.24, Amazon Linux 2023, Arch Linux, CentOS Stream 9 and 10, Debian 12 and 13, Fedora 42 through 44, Gentoo, Kali Linux 2026.1, Linux Mint 22.3, NixOS, openSUSE Tumbleweed, Pop OS, Rocky Linux 9 and 10, and Ubuntu 22.04. Ubuntu 24.04 systems were protected by default AppArmor restrictions unless those protections were bypassed using the proof of concept fallback method, while Ubuntu 26.04 blocked the ordinary user attack path unless AppArmor namespace restrictions were disabled.
The Linux kernel community released upstream fixes on July 24, with corrected versions available in Linux 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. Kernel branches that have reached end of life, including versions 6.13 through 6.17, 6.19, and 7.0, will not receive upstream security fixes. Because Linux distributions commonly backport patches, administrators are advised to rely on vendor specific security advisories instead of upstream version numbers when determining whether their systems are protected. Where patched kernels are not yet available and Open vSwitch is unnecessary, security experts recommend preventing the Open vSwitch module from loading, unloading the module if it is already active, or rebooting affected systems after applying configuration changes. Disabling unprivileged user namespaces can also reduce the local attack surface, although it does not prevent attacks originating from containers or processes that already possess CAP NET ADMIN privileges within attacker controlled network namespaces. Researchers noted that environments hosting multiple users or untrusted workloads face increased risk because a compromise of a single low privilege account could potentially be escalated into complete system control through the OVSwrap vulnerability.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
