Loading story…
A newly disclosed Linux kernel local privilege escalation flaw, CVE-2026-64531 or OVSwrap, allows unprivileged local users to obtain root by exploiting the Open vSwitch kernel datapath. The bug stems from improper handling of nested Netlink action lengths, where a 16-bit length field can wrap beyond 65,535 bytes and cause the kernel to interpret attacker-controlled data as valid actions, leading to deterministic memory corruption. Reports say the issue is broadly exploitable across many default Linux distributions and can be reached from an unprivileged user and network namespace with CAP_NET_ADMIN inside that namespace.
Public reporting says exploitation is unusually practical because it requires no memory grooming and no pre-existing OVS bridge or daemon, while a proof of concept reportedly supports about 800 x86-64 kernel builds. The flaw became easier to exploit after Open vSwitch removed a 32 KB action-size limit in 2025, exposing a long-hidden integer truncation bug. Patched stable kernel releases are available, and defenders are being urged to prioritize vendor kernel updates, blacklist or prevent loading of the openvswitch module where it is not needed, restrict unprivileged user namespaces where feasible, and consider temporary eBPF/BPF-based mitigations until systems are updated.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
A 2025 change in Open vSwitch removed a long-standing action-size limit of roughly 32 KB, making a previously latent length-handling flaw in the kernel datapath practically exploitable. Both references state the underlying vulnerable code had existed for about 13 years before this change.
A public proof of concept was reported that supports roughly 800 x86-64 kernel builds and demonstrates exploitation across many default Linux distributions. The references say the exploit can work without a pre-existing OVS bridge or running ovs-vswitchd and can be reached from user and network namespaces.
Security researcher Asim Manizada disclosed CVE-2026-64531, dubbed OVSwrap, a Linux kernel local privilege-escalation vulnerability in the Open vSwitch datapath. The flaw allows an unprivileged local user to gain root privileges under common conditions by abusing a 16-bit Netlink length wraparound.
Before public disclosure, the Linux kernel community released stable kernel updates addressing CVE-2026-64531. One reference identifies the first corrected versions as 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethecybersecguru.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **OVSwrap** (`CVE-2026-64531`), a local privilege-escalation flaw in the Linux kernel's Open vSwitch datapath that can let an unprivileged user gain **root code execution** on affected systems. The bug occurs when Open vSwitch expands validated userspace actions into larger internal Netlink attributes and a generated nested attribute exceeds `65,535` bytes, causing the 16-bit `nla_len` field to wrap and later parsers to trust a corrupted length. The issue is exploitable when the OVS kernel datapath and conntrack/FTP-helper support are present and either unprivileged user or network namespaces are enabled, or an attacker controls a network namespace with `CAP_NET_ADMIN`. The disclosure said a proof of concept can use attacker-controlled conntrack labels and timeout names to forge actions, leak kernel pointers, read kernel memory, alter targeted values, corrupt host process credentials, and ultimately write a `sudoers` rule for root execution. Upstream fixes were released in commit `3f1f75536668` and shipped in stable kernels `5.15.212`, `6.1.178`, `6.6.145`, `6.12.97`, `6.18.40`, and `7.1.5`. The reports identified multiple stock-default exploitable distributions, including **Ubuntu 22.04/24.04, Debian 12/13, Fedora 42-44, Arch Linux, AlmaLinux, Rocky Linux, NixOS, and Kali Linux**, and recommended mitigations such as unloading or blocking the `openvswitch` module, disabling unprivileged user namespaces, or applying an emergency BPF-based mitigation.
Aug 22, 2026
Researchers disclosed a deterministic Linux local privilege-escalation primitive affecting Open vSwitch forwarding paths, tracked as **CVE-2026-90049**, **CVE-2026-89487**, and **CVE-2026-80977**. A failed Open vSwitch userspace upcall can invoke `skb_tx_error()` on an skb that remains in use, clearing ownership metadata while page-cache fragments remain attached. An unprivileged user able to create user namespaces and administer networking within their own namespace can combine `MSG_ZEROCOPY`, an attacker-controlled OVS datapath, and ESP-in-UDP handling to write chosen plaintext into read-only, root-owned file page-cache pages before ESP authentication fails. The transient page-cache modification can alter an in-memory setuid-root binary and produce root privileges when that program executes. Default deployments of Arch Linux, Fedora, Debian, Amazon Linux, and Red Hat Enterprise Linux may be exposed where unprivileged user namespaces are enabled, Open vSwitch autoloads, and kernels contain the relevant Fragnesia changes. Fixes have landed upstream and began reaching stable kernels; organizations should apply vendor kernel updates and, pending patching, disable unprivileged user namespaces or prevent Open vSwitch and ESP module autoloading where operationally feasible.
Sep 17, 2026
Researchers disclosed two separate Linux kernel privilege-escalation flaws that can give local attackers **root** access across a wide range of systems, including servers, desktops, and Android devices. One bug, **`CVE-2026-46242`** or **Bad Epoll**, is a use-after-free race in the kernel's `epoll` subsystem that was reportedly exploited through Google's kernelCTF program and shown to be broadly reachable because `epoll` is a core component that cannot be disabled. The flaw was introduced by a 2023 kernel change, and reporting said an initial patch attempt was insufficient before a correct fix was merged weeks later, leaving defenders dependent on upstream fixes and vendor backports. A second flaw, **`CVE-2026-43456`**, affects the kernel's `net/bonding` subsystem and stems from a type-confusion condition dating back to 2007. Researchers said the bug can be exploited with high reliability for local root by abusing incompatible `header_ops` handling in bonded network devices, enabling controlled memory corruption and eventual code execution. The issue reportedly affects Linux versions **2.6.24 through 6.12.77** and requires **`CAP_NET_ADMIN`** privileges; mitigations include applying the March 2026 patch, or temporarily disabling unprivileged user namespaces or the bonding module where feasible.
Aug 25, 2026