New Linux Kernel Vulnerability (CVE-2026-64531) Enables Local Privilege Escalation via OVSwrap Flaw
A critical Linux kernel vulnerability, tracked as CVE-2026-64531 and dubbed OVSwrap, has been disclosed, allowing unprivileged local users to escalate privileges to root on a wide range of Linux distributions. The flaw resides in the Open vSwitch (OVS) kernel datapath, a networking component commonly used in cloud, container, and virtualization environments.
The vulnerability was discovered by researcher Asim Viladi Oglu Manizada using an experimental approach combining large language models with structured memory-geometry visualizations to analyze complex kernel memory bugs. The issue stems from a 16-bit length field limitation in Netlink attributes, which OVS uses to store network actions. While the kernel permits action streams exceeding 64 KiB, it failed to validate whether individual nested actions such as a CLONE wrapping multiple small conntrack actions remained under the 16-bit ceiling.
When an attacker crafts an action large enough to exceed 65,535 bytes, the stored length value wraps around to a small number. The kernel then misinterprets attacker-controlled data as legitimate actions, enabling exploitation without memory grooming. The attack is highly reliable, resembling a logic bug rather than a traditional memory-corruption flaw.
Exploitation requires no pre-existing OVS bridge, daemon, or administrative rights an unprivileged local user can trigger the vulnerability by creating a user and network namespace (e.g., via unshare -Urn), gaining CAP_NET_ADMIN, and initializing a private OVS datapath. Since most distributions ship OVS as a loadable kernel module that auto-loads on demand, the attack surface exists even on systems where OVS was never explicitly installed.
The flaw affects default configurations across major Linux distributions, including AlmaLinux, Debian, Fedora, Ubuntu, Rocky Linux, Arch Linux, openSUSE Tumbleweed, Amazon Linux, Kali Linux, NixOS, and Linux Mint. Some systems require minor configuration adjustments, while older kernel branches (pre-2025) remain unaffected. The vulnerable code existed for 13 years but only became exploitable after a size limit was removed in 2025.
Patches have been released in stable kernel versions 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. Temporary mitigations include blacklisting the openvswitch module, disabling unprivileged user namespaces, or deploying an emergency BPF-based mitigation released alongside the proof-of-concept.
Source: https://cybersecuritynews.com/ovswrap-linux-vulnerability/
AlmaLinux TPRM report: https://www.rankiteo.com/company/tuxcare
Fedora TPRM report: https://www.rankiteo.com/company/fedora-project
Linux Kernel TPRM report: https://www.rankiteo.com/company/the-linux-foundation
Debian TPRM report: https://www.rankiteo.com/company/debian
Ubuntu TPRM report: https://www.rankiteo.com/company/ubuntu-linux
Rocky Linux TPRM report: https://www.rankiteo.com/company/rockylinux
Amazon Linux TPRM report: https://www.rankiteo.com/company/amazon-web-services
Linux Mint TPRM report: https://www.rankiteo.com/company/the-linux-foundation
Kali Linux TPRM report: https://www.rankiteo.com/company/kali-linux
"id": "tuxuburocdebtheamakalfed1785940491",
"linkid": "tuxcare, ubuntu-linux, rockylinux, debian, the-linux-foundation, amazon-web-services, kali-linux, fedora-project",
"type": "Vulnerability",
"date": "1/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Technology',
'name': 'AlmaLinux',
'type': 'Operating System'},
{'industry': 'Technology',
'name': 'Debian',
'type': 'Operating System'},
{'industry': 'Technology',
'name': 'Fedora',
'type': 'Operating System'},
{'industry': 'Technology',
'name': 'Ubuntu',
'type': 'Operating System'},
{'industry': 'Technology',
'name': 'Rocky Linux',
'type': 'Operating System'},
{'industry': 'Technology',
'name': 'Arch Linux',
'type': 'Operating System'},
{'industry': 'Technology',
'name': 'openSUSE Tumbleweed',
'type': 'Operating System'},
{'industry': 'Technology',
'name': 'Amazon Linux',
'type': 'Operating System'},
{'industry': 'Technology',
'name': 'Kali Linux',
'type': 'Operating System'},
{'industry': 'Technology',
'name': 'NixOS',
'type': 'Operating System'},
{'industry': 'Technology',
'name': 'Linux Mint',
'type': 'Operating System'}],
'attack_vector': 'Local',
'description': 'A critical Linux kernel vulnerability, tracked as '
'CVE-2026-64531 and dubbed OVSwrap, has been disclosed, '
'allowing unprivileged local users to escalate privileges to '
'root on a wide range of Linux distributions. The flaw resides '
'in the Open vSwitch (OVS) kernel datapath, a networking '
'component commonly used in cloud, container, and '
'virtualization environments. The vulnerability was discovered '
'by researcher Asim Viladi Oglu Manizada using an experimental '
'approach combining large language models with structured '
'memory-geometry visualizations. The issue stems from a 16-bit '
'length field limitation in Netlink attributes, which OVS uses '
'to store network actions. Exploitation requires no '
'pre-existing OVS bridge, daemon, or administrative rights, '
'making it highly accessible to unprivileged local users.',
'impact': {'operational_impact': 'Potential full system compromise via root '
'access',
'systems_affected': 'Linux distributions with vulnerable Open '
'vSwitch kernel module'},
'post_incident_analysis': {'corrective_actions': 'Patches released for '
'affected kernel versions. '
'Temporary mitigations '
'include blacklisting the '
'openvswitch module, '
'disabling unprivileged user '
'namespaces, or deploying '
'BPF-based mitigations.',
'root_causes': '16-bit length field limitation in '
'Netlink attributes used by Open '
'vSwitch (OVS), leading to integer '
'wrap-around when action streams '
'exceed 65,535 bytes. The '
'vulnerable code existed for 13 '
'years but became exploitable after '
'a size limit was removed in 2025.'},
'recommendations': 'Apply patches in stable kernel versions 5.15.212, '
'6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. Implement '
'temporary mitigations such as blacklisting the '
'openvswitch module or disabling unprivileged user '
'namespaces.',
'references': [{'source': 'Researcher Asim Viladi Oglu Manizada'}],
'response': {'containment_measures': ['Blacklisting the openvswitch module',
'Disabling unprivileged user namespaces',
'Deploying an emergency BPF-based '
'mitigation'],
'remediation_measures': 'Patches released in stable kernel '
'versions 5.15.212, 6.1.178, 6.6.145, '
'6.12.97, 6.18.40, and 7.1.5'},
'title': 'New Linux Kernel Vulnerability (CVE-2026-64531) Enables Local '
'Privilege Escalation via OVSwrap Flaw',
'type': 'Local Privilege Escalation',
'vulnerability_exploited': 'CVE-2026-64531 (OVSwrap)'}