Linux Kernel Open vSwitch Flaw Allows Local Root Privilege Escalation

Vulnerability Details

A memory corruption vulnerability, tracked as CVE-2026-64531 and codenamed OVSwrap, has been discovered in the Linux kernel's Open vSwitch datapath. This flaw enables ordinary local users to achieve root privileges on a wide range of default-configured Linux distributions. The vulnerability was publicly disclosed by security researcher Asim Manizada on July 28, 2026.

Exploitation Mechanism

The bug resides in the kernel datapath, not the userspace ovs-vswitchd daemon. An attacker does not require an existing OVS bridge, a running ovs-vswitchd, or host-level CAP_NET_ADMIN. On affected systems with the OVS kernel datapath and enabled unprivileged user namespaces, a user can create private user and network namespaces, gain CAP_NET_ADMIN within that namespace, and access the vulnerable flow-installation path. Even if the openvswitch module is not loaded, resolving its Generic Netlink family name can load it automatically, meaning an empty lsmod output does not guarantee safety.

Root Cause and History

The vulnerability stems from an unsafe assignment in Open vSwitch, where generated flow actions are stored as Netlink attributes with a 16-bit nla_len field, capping single nested attributes at 65,535 bytes. This unsafe assignment existed for 13 years, but a 32 KiB cap on the total generated action stream previously prevented the issue. A March 2025 change removed this cap to address unpredictable failures, including in large OpenStack deployments, inadvertently exposing the older truncation bug. The review for this enabling commit focused on reliability and user-facing failures, overlooking the security implications of removing the safeguard.

Patch Availability and Mitigation

Upstream fixes were shipped in stable kernel trees on July 24. The first patched upstream releases include Linux 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. End-of-life kernel series (6.13 through 6.17, 6.19, and 7.0) will not receive upstream stable fixes. Users should consult their distribution's vendor tracker for specific kernel updates, as distribution kernels often include backports and downstream changes. If a patched vendor kernel is not yet available and Open vSwitch is not required, users can block future module loads or, if the module is already resident, unload it or reboot.