OVSwrap Open vSwitch Flaw Lets Local Linux Users Gain Root

A newly disclosed Linux kernel local privilege escalation flaw, CVE-2026-64531 or OVSwrap, allows unprivileged local users to obtain root by exploiting the Open vSwitch kernel datapath. The bug stems from improper handling of nested Netlink action lengths, where a 16-bit length field can wrap beyond 65,535 bytes and cause the kernel to interpret attacker-controlled data as valid actions, leading to deterministic memory corruption. Reports say the issue is broadly exploitable across many default Linux distributions and can be reached from an unprivileged user and network namespace with CAP_NET_ADMIN inside that namespace.

Public reporting says exploitation is unusually practical because it requires no memory grooming and no pre-existing OVS bridge or daemon, while a proof of concept reportedly supports about 800 x86-64 kernel builds. The flaw became easier to exploit after Open vSwitch removed a 32 KB action-size limit in 2025, exposing a long-hidden integer truncation bug. Patched stable kernel releases are available, and defenders are being urged to prioritize vendor kernel updates, blacklist or prevent loading of the openvswitch module where it is not needed, restrict unprivileged user namespaces where feasible, and consider temporary eBPF/BPF-based mitigations until systems are updated.