Loading vulnerability…
OVSwrap
OVSwrap is a length-validation vulnerability in the Linux kernel Open vSwitch subsystem. Generated flow actions are stored as Netlink attributes whose nla_len field is 16 bits. A change permitting total action streams larger than 64 KiB also removed the safeguard preventing individual generated nested action containers from exceeding 65,535 bytes. Closing an oversized container truncates its recorded length, causing subsequent dump or teardown operations to traverse a structurally different action stream from the one originally validated. In particular, oversized nested CLONE or CT actions can cause attacker-controlled bytes within the generated stream to be interpreted as independent actions. Exploitation can enable local privilege escalation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can elevate a low-privileged local attacker to root and compromise system confidentiality, integrity, and availability. Public proof-of-concept behavior includes obtaining kernel exploitation primitives, installing a passwordless sudo rule, and launching a privileged shell. Incorrect action-stream traversal during dump or teardown can also cause kernel instability. Vulnerability-specific scoring identifies local access, low privileges, and no required user interaction.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is specified. Until the fix is active, restrict untrusted local code execution and access to Open vSwitch configuration interfaces. Restricting unprivileged user and network namespace creation may reduce exposure to the demonstrated namespace-based exploitation route, but is not established as a complete mitigation.
Patch, then assume compromise.
Install the vendor kernel update containing the fix for CVE-2026-64531 and reboot, or apply an explicitly supported vendor live patch. The upstream correction rejects generated nested action containers whose lengths cannot fit in nla_len and propagates failures through all callers. It also unwinds resource-owning action-list tails in reverse construction order before removing failed wrappers, with appropriate ownership cleanup for SET/TUNNEL actions. Applicable fixed packages include Ubuntu 24.04 LTS OEM 6.17.0-1033.33, Ubuntu 24.04 LTS HWE 7.0.0-30.30~24.04.1, Ubuntu 26.04 LTS Oracle 7.0.0-1010.10, and Debian stable Linux 6.12.100-1. Use the update matching the distribution and kernel flavor; rebuild third-party modules where the update changes the kernel ABI.
No validated public exploits yet. Hidden: 5 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
108 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.