A newly identified security flaw in the Linux kernel, designated as CVE-2026-64531 and referred to as OVSwrap, enables unprivileged local users to escalate their privileges to root across numerous popular Linux distributions. This vulnerability resides within the Open vSwitch (OVS) kernel datapath, a critical networking component extensively utilized in cloud, container, and virtualization platforms.
The discovery of OVSwrap was achieved through an innovative research methodology that combines large language models with structured memory-geometry visualizations to analyze complex kernel memory issues. This approach was pioneered by security researcher Asim Viladi Oglu Manizada.
Technical Details of OVSwrap
Open vSwitch processes a sequence of network “actions” from userspace, converting them into an internal format stored using Netlink attributes. Each attribute includes a length field limited to 16 bits. While the kernel allows the overall action stream to exceed 64 KiB, it previously did not verify whether an individual nested action, such as a CLONE encapsulating multiple small conntrack actions, remained within the 16-bit limit.
An attacker can exploit this by crafting an action that surpasses the 65,535-byte threshold, causing the stored length value to wrap around to a smaller number. Subsequent kernel code, trusting this wrapped value, resumes parsing from an incorrect position within attacker-controlled data, leading the parser to interpret forged data as legitimate actions.
Notably, conntrack fields like labels and timeout names are under attacker control, and the wraparound occurs at a predictable offset once the kernel build is known. This predictability allows for reliable exploitation without the need for memory grooming, making it more akin to a logic flaw than a typical memory corruption issue.
Exploitation and Impact
Exploitation does not require an existing OVS bridge, a running switch daemon, or administrative rights at the host level. An unprivileged local user can create a user and network namespace using commands like unshare -Urn, gain CAP_NET_ADMIN within that isolated namespace, and initiate a private OVS datapath to access the vulnerable code path.
Since many distributions provide OVS as a loadable kernel module that auto-loads on demand, the attack surface exists even on systems where OVS was not intentionally installed or activated. This technique could also potentially be used for container escape scenarios.
Security researchers have confirmed the exploitability of this vulnerability in default configurations across a wide range of Linux distributions, including AlmaLinux, Debian, Fedora, Ubuntu, Rocky Linux, Arch Linux, openSUSE Tumbleweed, Amazon Linux, Kali Linux, NixOS, and Linux Mint. Some systems may require minor configuration adjustments to become exploitable, while older kernel versions that did not receive a related 2025 change remain unaffected.
The vulnerable code has been present in the kernel for approximately thirteen years but only became exploitable after a previous size limit was removed last year.
Mitigation and Recommendations
The issue was responsibly disclosed to the kernel security team and OVS maintainers, resulting in fixes being incorporated into stable kernel releases, including versions 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5.
Administrators who cannot immediately apply patches are advised to take the following actions:
- Blacklist the
openvswitchmodule if it is not required. - Disable unprivileged user namespaces where feasible.
- Deploy the emergency BPF-based mitigation released alongside the proof-of-concept.
However, upgrading affected kernels remains the most reliable defense against this vulnerability.
The OVSwrap vulnerability underscores the critical importance of rigorous input validation within kernel components, especially those handling complex data structures like network actions. It also highlights the necessity for continuous security assessments and the adoption of innovative research methodologies to uncover and address latent vulnerabilities in widely used systems.
