Loading story…
Researchers disclosed a deterministic Linux local privilege-escalation primitive affecting Open vSwitch forwarding paths, tracked as CVE-2026-90049, CVE-2026-89487, and CVE-2026-80977. A failed Open vSwitch userspace upcall can invoke skb_tx_error() on an skb that remains in use, clearing ownership metadata while page-cache fragments remain attached. An unprivileged user able to create user namespaces and administer networking within their own namespace can combine MSG_ZEROCOPY, an attacker-controlled OVS datapath, and ESP-in-UDP handling to write chosen plaintext into read-only, root-owned file page-cache pages before ESP authentication fails.
The transient page-cache modification can alter an in-memory setuid-root binary and produce root privileges when that program executes. Default deployments of Arch Linux, Fedora, Debian, Amazon Linux, and Red Hat Enterprise Linux may be exposed where unprivileged user namespaces are enabled, Open vSwitch autoloads, and kernels contain the relevant Fragnesia changes. Fixes have landed upstream and began reaching stable kernels; organizations should apply vendor kernel updates and, pending patching, disable unprivileged user namespaces or prevent Open vSwitch and ESP module autoloading where operationally feasible.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
The remediation, consisting of three patches including a change to preserve shared-SKB state in skb_tx_error(), landed in mainline and began shipping in stable kernels. Organizations were advised to apply their distribution kernel updates for CVE-2026-90049, CVE-2026-89487, and CVE-2026-80977.
The Open vSwitch/ESP issue, characterized as a bypass of protections for Fragnesia (CVE-2026-46300), was publicly discussed on the netdev mailing list.
The Open vSwitch forwarding-path flaws tracked as CVE-2026-90049, CVE-2026-89487, and CVE-2026-80977 were reported to the Linux kernel security team. The issue could allow a local attacker with unprivileged user and network namespaces to alter root-owned file page-cache contents through Open vSwitch and ESP processing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **OVSwrap** (`CVE-2026-64531`), a local privilege-escalation flaw in the Linux kernel's Open vSwitch datapath that can let an unprivileged user gain **root code execution** on affected systems. The bug occurs when Open vSwitch expands validated userspace actions into larger internal Netlink attributes and a generated nested attribute exceeds `65,535` bytes, causing the 16-bit `nla_len` field to wrap and later parsers to trust a corrupted length. The issue is exploitable when the OVS kernel datapath and conntrack/FTP-helper support are present and either unprivileged user or network namespaces are enabled, or an attacker controls a network namespace with `CAP_NET_ADMIN`. The disclosure said a proof of concept can use attacker-controlled conntrack labels and timeout names to forge actions, leak kernel pointers, read kernel memory, alter targeted values, corrupt host process credentials, and ultimately write a `sudoers` rule for root execution. Upstream fixes were released in commit `3f1f75536668` and shipped in stable kernels `5.15.212`, `6.1.178`, `6.6.145`, `6.12.97`, `6.18.40`, and `7.1.5`. The reports identified multiple stock-default exploitable distributions, including **Ubuntu 22.04/24.04, Debian 12/13, Fedora 42-44, Arch Linux, AlmaLinux, Rocky Linux, NixOS, and Kali Linux**, and recommended mitigations such as unloading or blocking the `openvswitch` module, disabling unprivileged user namespaces, or applying an emergency BPF-based mitigation.
Aug 22, 2026
A newly disclosed Linux kernel local privilege escalation flaw, **CVE-2026-64531** or **OVSwrap**, allows unprivileged local users to obtain **root** by exploiting the Open vSwitch kernel datapath. The bug stems from improper handling of nested Netlink action lengths, where a **16-bit length field** can wrap beyond `65,535` bytes and cause the kernel to interpret attacker-controlled data as valid actions, leading to deterministic memory corruption. Reports say the issue is broadly exploitable across many default Linux distributions and can be reached from an unprivileged user and network namespace with `CAP_NET_ADMIN` inside that namespace. Public reporting says exploitation is unusually practical because it requires no memory grooming and no pre-existing OVS bridge or daemon, while a proof of concept reportedly supports about **800 x86-64 kernel builds**. The flaw became easier to exploit after Open vSwitch removed a **32 KB action-size limit** in 2025, exposing a long-hidden integer truncation bug. Patched stable kernel releases are available, and defenders are being urged to prioritize vendor kernel updates, blacklist or prevent loading of the `openvswitch` module where it is not needed, restrict unprivileged user namespaces where feasible, and consider temporary **eBPF/BPF-based** mitigations until systems are updated.
Aug 6, 2026
Two Linux kernel vulnerabilities, **CVE-2026-53362** and **CVE-2026-53366**, were disclosed in the UDP packet handling path and can allow a local unprivileged user to escalate privileges to root. The flaws affect the IPv6 UDPv6 path and the IPv4 UDP path when `MSG_SPLICE_PAGES` is used with UDP corking and a datagram crosses a fragment boundary, causing a heap out-of-bounds write. Researchers said incorrect `fraggap` accounting lets validation be bypassed, leading to corruption of `skb_shared_info` metadata and manipulation of the `nr_frags` field, which can ultimately produce a use-after-free condition exploitable for local privilege escalation. The bugs affect Linux kernels from **v6.1 onward**. The IPv6 issue requires `CONFIG_IPV6=y`, while the IPv4 variant also depends on access conditions tied to user namespaces. Fixes were published in upstream commits `736b380e28d0` for IPv6 and `eca856950f7c` for IPv4, and were released in stable kernel versions including **7.1.3, 6.18.38, 6.12.95, 6.6.144, and 6.1.177**. Advisories or updates were issued by major distributions including **Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch, and Fedora**.
Jul 23, 2026