OVSwrap: Open vSwitch datapath vulnerability enables root escalation

Memory corruption in the Linux kernel

The CVE-2026-64531 vulnerability, dubbed OVSwrap, affects the Open vSwitch kernel datapath and has a CVSS score of 7.8, rated high.

An unprivileged local user can exploit it to gain root privileges, provided the openvswitch kernel module and unprivileged user namespaces are available. An existing OVS bridge, a running ovs-vswitchd process, or CAP_NET_ADMIN on the host are not required.

The issue does not affect the ovs-vswitchd userspace daemon. The module may also be loaded automatically, even when it does not appear in lsmod output.

The vulnerability was reported to the kernel security team and Open vSwitch maintainers on June 19, 2026. The upstream fix reached the stable trees on July 24, 2026, while Asim Manizada disclosed the issue on July 28, 2026.

The technical origin of OVSwrap

The root cause dates back to a change introduced in March 2025, which removed the 32 KiB limit on the stream of generated actions.

Beyond 65,535 bytes, a 16-bit Netlink field can overflow. The kernel then interprets attacker-controlled data as valid OVS actions, creating a memory-corruption condition in the datapath.

The published exploit combines pointer leaks, arbitrary reads, and a targeted modification of kernel credentials. The PoC can alter sudoers, open a root shell, and leave changes in Open vSwitch processes and state.

The exploit repository includes profiles for approximately 800 x86-64 kernel builds and attempts to dynamically calculate the required parameters for builds not included in the profiles.

Affected systems and available fixes

The published tests found systems based on, among others, AlmaLinux, Alpine, Amazon Linux 2023, Arch, CentOS Stream, Debian 12 and 13, Fedora, Gentoo, Kali, Linux Mint, NixOS, openSUSE Tumbleweed, Pop!_OS, Rocky Linux, and Ubuntu 22.04 to be exploitable.

Ubuntu 24.04 required a bypass of AppArmor restrictions. Ubuntu 26.04 blocked the tested attack path in its default configuration. Amazon Linux 2, Debian 11, Rocky Linux 8, and Ubuntu 20.04 were not exploitable with this technique.

The fixed upstream versions are:

• 5.15.212
• 6.1.178
• 6.6.145
• 6.12.97
• 6.18.40
• 7.1.5

Administrators should install the kernel provided by their vendor. Upstream version numbers alone do not guarantee that the fix is present, as distributions may apply backports. The 6.13–6.17, 6.19, and 7.0 series will not receive upstream stable fixes.

Mitigations for Linux hosts

If Open vSwitch is not required, new module loads can be blocked:

echo 'install openvswitch /bin/false' > /etc/modprobe.d/ovswrap.conf

If the module is already loaded, it must be unloaded or the system rebooted. Another mitigation is to disable unprivileged user namespaces, removing the standard path used for local privilege escalation.