OVSwrap Linux Kernel Open vSwitch Flaw Enables Local Root Access

Researchers disclosed OVSwrap (CVE-2026-64531), a local privilege-escalation flaw in the Linux kernel's Open vSwitch datapath that can let an unprivileged user gain root code execution on affected systems. The bug occurs when Open vSwitch expands validated userspace actions into larger internal Netlink attributes and a generated nested attribute exceeds 65,535 bytes, causing the 16-bit nla_len field to wrap and later parsers to trust a corrupted length. The issue is exploitable when the OVS kernel datapath and conntrack/FTP-helper support are present and either unprivileged user or network namespaces are enabled, or an attacker controls a network namespace with CAP_NET_ADMIN.

The disclosure said a proof of concept can use attacker-controlled conntrack labels and timeout names to forge actions, leak kernel pointers, read kernel memory, alter targeted values, corrupt host process credentials, and ultimately write a sudoers rule for root execution. Upstream fixes were released in commit 3f1f75536668 and shipped in stable kernels 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. The reports identified multiple stock-default exploitable distributions, including Ubuntu 22.04/24.04, Debian 12/13, Fedora 42-44, Arch Linux, AlmaLinux, Rocky Linux, NixOS, and Kali Linux, and recommended mitigations such as unloading or blocking the openvswitch module, disabling unprivileged user namespaces, or applying an emergency BPF-based mitigation.