Loading story…
Researchers disclosed OVSwrap (CVE-2026-64531), a local privilege-escalation flaw in the Linux kernel's Open vSwitch datapath that can let an unprivileged user gain root code execution on affected systems. The bug occurs when Open vSwitch expands validated userspace actions into larger internal Netlink attributes and a generated nested attribute exceeds 65,535 bytes, causing the 16-bit nla_len field to wrap and later parsers to trust a corrupted length. The issue is exploitable when the OVS kernel datapath and conntrack/FTP-helper support are present and either unprivileged user or network namespaces are enabled, or an attacker controls a network namespace with CAP_NET_ADMIN.
The disclosure said a proof of concept can use attacker-controlled conntrack labels and timeout names to forge actions, leak kernel pointers, read kernel memory, alter targeted values, corrupt host process credentials, and ultimately write a sudoers rule for root execution. Upstream fixes were released in commit 3f1f75536668 and shipped in stable kernels 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. The reports identified multiple stock-default exploitable distributions, including Ubuntu 22.04/24.04, Debian 12/13, Fedora 42-44, Arch Linux, AlmaLinux, Rocky Linux, NixOS, and Kali Linux, and recommended mitigations such as unloading or blocking the openvswitch module, disabling unprivileged user namespaces, or applying an emergency BPF-based mitigation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Asim Manizada published a write-up on OVSwrap describing the Linux kernel Open vSwitch local root vulnerability. The post is referenced as a source alongside the later oss-security disclosure.
The OVSwrap flaw, tracked as CVE-2026-64531, was originally reported to security@kernel.org and Open vSwitch maintainers. The bug can enable local privilege escalation to root on affected Linux systems using the OVS kernel datapath.
A March 2025 change removed the previous 32 KiB cap on Open vSwitch's generated internal action stream. The disclosure says this allowed generated nested attributes to exceed 64 KiB and exposed the missing length check that underlies OVSwrap.
Asim Manizada disclosed OVSwrap publicly on oss-security after the linux-distros embargo expired. The disclosure included technical details, proof-of-concept behavior, affected distributions, and mitigations such as unloading the openvswitch module, disabling unprivileged user namespaces, or using an emergency BPF mitigation.
Upstream published the fix as commit 3f1f75536668, titled "net: openvswitch: reject oversized nested action attrs." The disclosure says the first fixed stable kernel releases were 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethehackernews.com
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceheyitsas.im
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two separate Linux kernel privilege-escalation flaws that can give local attackers **root** access across a wide range of systems, including servers, desktops, and Android devices. One bug, **`CVE-2026-46242`** or **Bad Epoll**, is a use-after-free race in the kernel's `epoll` subsystem that was reportedly exploited through Google's kernelCTF program and shown to be broadly reachable because `epoll` is a core component that cannot be disabled. The flaw was introduced by a 2023 kernel change, and reporting said an initial patch attempt was insufficient before a correct fix was merged weeks later, leaving defenders dependent on upstream fixes and vendor backports. A second flaw, **`CVE-2026-43456`**, affects the kernel's `net/bonding` subsystem and stems from a type-confusion condition dating back to 2007. Researchers said the bug can be exploited with high reliability for local root by abusing incompatible `header_ops` handling in bonded network devices, enabling controlled memory corruption and eventual code execution. The issue reportedly affects Linux versions **2.6.24 through 6.12.77** and requires **`CAP_NET_ADMIN`** privileges; mitigations include applying the March 2026 patch, or temporarily disabling unprivileged user namespaces or the bonding module where feasible.
Jul 11, 2026
Researchers and vendors disclosed **CVE-2026-46333**, a Linux kernel flaw in `__ptrace_may_access()` that lets an unprivileged local user exploit a process-exit race to bypass authorization checks and steal file descriptors from privileged processes. The bug has existed since Linux `v4.10-rc1`, and exploitation became more practical with `pidfd_getfd()` introduced in `v5.6-rc1`. Qualys and public proof-of-concept authors showed the issue can expose `/etc/shadow`, leak OpenSSH host private keys through `ssh-keysign`, and in some cases execute commands as root via targets including `chage`, `pkexec`, and `accounts-daemon` on default Debian, Ubuntu, Fedora, AlmaLinux, and other distributions. Linus Torvalds merged the upstream fix in commit `31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a`, and stable kernel updates were released across multiple branches as distributions began shipping patched packages. Public exploit code appeared almost immediately after the fix became visible, increasing the urgency for defenders to patch and reboot affected systems, rotate potentially exposed **SSH host keys** and other credentials, and review systems for local privilege-escalation activity. Where immediate patching is not possible, several vendors and Qualys said raising `kernel.yama.ptrace_scope` to `2` or `3` can block known exploit paths, although maintainers cautioned that such settings are only a temporary workaround and may disrupt debugging tools.
Jul 23, 2026
Two newly disclosed Linux kernel local privilege escalation flaws are enabling attackers to gain root by corrupting file-backed page-cache memory without changing files on disk. **DirtyClone** (`CVE-2026-43503`) affects the XFRM/IPsec path and abuses cloned packets after a shared-fragment safety flag is dropped during internal copying, while **pedit COW** (`CVE-2026-46331`) affects the traffic-control `act_pedit` subsystem through an out-of-bounds write. Public exploit material shows both bugs can poison the in-memory copy of privileged binaries such as `/usr/bin/su` or `/bin/su`, then execute them to obtain root access while evading file-integrity checks and, in DirtyClone’s case, potentially leaving no on-disk changes or kernel audit evidence. Exploitation in both cases depends on local access plus `CAP_NET_ADMIN`, which researchers say can often be obtained through unprivileged user namespaces on distributions such as Debian, Fedora, and RHEL by default. Reported testing showed successful exploitation on Debian 13 and RHEL 10, with Ubuntu 24.04 requiring an AppArmor-permitted path and Ubuntu 26.04 blocking some default routes despite vulnerable kernels. Upstream fixes have already landed in the Linux 7.1 release candidates, and vendors including Ubuntu, Debian, SUSE, and Red Hat have issued advisories or patches; defenders are being urged to deploy patched kernels, reboot affected systems, and consider disabling unprivileged user namespaces or blocking `act_pedit` where immediate patching is not possible.
Jul 23, 2026