A critical flaw in the Linux kernel’s Open vSwitch component could enable local users to escalate privileges to root on numerous default-configured distributions. This vulnerability, identified as CVE-2026-64531 and named OVSwrap, was disclosed by security researcher Asim Manizada on July 28, 2026.
Details of the Vulnerability
The flaw resides within the kernel datapath rather than the userspace ovs-vswitchd daemon. Manizada’s technical analysis reveals that attackers do not require an existing OVS bridge, a running ovs-vswitchd, or host-level CAP_NET_ADMIN privileges to exploit this vulnerability. On systems where the OVS kernel datapath is accessible and unprivileged user namespaces are active, users can create private user and network namespaces, gaining CAP_NET_ADMIN and accessing the vulnerable flow-installation path.
Even if the openvswitch module is not loaded, querying its Generic Netlink family name can trigger its automatic loading, leaving systems vulnerable unless the module is explicitly blocked. A fix has been provided in stable kernel releases since July 24.
Exploitation and Impact
The flaw, which results from a memory corruption issue, has been present for over a decade due to unsafe assignments in OVS. Actions stored as Netlink attributes have a length field that can overflow, allowing attackers to create an exploit chain using kernel pointer leaks, arbitrary reads, and targeted decrements. This can ultimately lead to unauthorized root access.
The proof-of-concept exploit requires specific conditions, such as installed OVS conntrack support and sudo. Upon successful exploitation, it modifies critical system files like /etc/sudoers to open a root shell, leaving behind processes to prevent unsafe teardown.
Mitigation Measures
System administrators are advised to install patched vendor kernels as soon as they become available. In environments where Open vSwitch is not needed, blocking the module from loading provides an immediate safeguard. Disabling unprivileged user namespaces can also mitigate the risk but may not protect against processes with existing CAP_NET_ADMIN privileges.
The risk is heightened in shared host environments, where a compromised account can exploit OVSwrap to escalate privileges across the entire server. For environments that must maintain both OVS and namespaces, an emergency BPF guard is recommended.
To conclude, while the vulnerability is severe, prompt action in applying patches and adjusting configurations can significantly reduce the risk of exploitation. Security teams should remain vigilant and monitor vendor updates to ensure comprehensive protection against this and similar threats.
