OVSwrap: A 13-Year-Old Linux Kernel Flaw That Lets Any Local User Escalate to Root

Vulnerability Overview

CVE-2026-64531 (OVSwrap) is a memory‑corruption flaw in the Open vSwitch kernel datapath module. It was disclosed on 2026-07-28 by security researcher Asim Manizada, who released a full proof‑of‑concept (PoC) together with precise offsets for roughly 800 x86‑64 kernel versions.

Technical Root Cause

The bug stems from the 16‑bit nla_len field used for Netlink attributes. Historically a hard‑coded 32 KiB limit on total generated flow actions acted as an accidental safety guard, keeping the nested attribute size below the 65 535‑byte limit. In March 2025 a kernel commit ( a1e64addf3ff) removed this 32 KiB guard to improve reliability for large OpenStack deployments, exposing the overflow.

Exploit Mechanism

An attacker sends a CLONE action containing hundreds of conntrack sub‑actions. On x86‑64 each conntrack expands to 164 bytes; when the total exceeds 65 535 bytes the 16‑bit nla_len wraps to a small value. The kernel then trusts the wrapped length and parses attacker‑controlled data, enabling:

Kernel pointer leakage via a forged OUTPUT action

Arbitrary kernel reads via a forged tunnel SET action

Targeted decrement‑by‑one writes via a crafted tun_dst pointer removal

The PoC spawns an auxiliary process, enters a user namespace, locates the credential structure, decrements fsuid and fsgid to zero, modifies /etc/sudoers.d/ or /etc/sudoers to install a persistent sudo rule, and launches a root shell while preserving OVS state.

Attack Preconditions and Affected Distributions

x86‑64 kernel with openvswitch.ko present

Unprivileged user namespace creation capability

OVS compiled with CONFIG_OPENVSWITCH and conntrack support

FTP conntrack helper installed

sudo installed for post‑exploitation actions

Distributions exploitable with default configuration include AlmaLinux 9/10, CentOS Stream 9/10, Rocky Linux 9/10, Alpine 3.22‑3.24, Arch, Gentoo, Kali 2026.1, Linux Mint 22.3, Amazon Linux 2023, Debian 12/13, Fedora 42‑44, NixOS, openSUSE Tumbleweed, Pop!_OS, and Ubuntu 22.04.

Partially mitigated releases: Ubuntu 24.04 (AppArmor blocks namespace creation but can be bypassed with aa‑exec -p trinity) and Ubuntu 26.04 (default blocks user paths unless AppArmor restrictions are disabled). Unaffected releases: Amazon Linux 2, Debian 11, Rocky Linux 8, Ubuntu 20.04.

Blue‑Team Response

MITRE ATT&CK Mapping

Privilege Escalation (T1068) – local privilege escalation via the vulnerability

Discovery (T1083) – file and directory discovery (e.g., scanning sudoers)

Persistence (T1098) – account manipulation (injecting sudoers rules)

Lateral Movement (T1078) – abuse of compromised root to spread across accounts

Emergency Response Checklist

Critical : Apply kernel patch or temporary mitigation to block the exploitation path.

Critical : Audit sudoers configuration and remove non‑team entries.

High : Inspect suspicious accounts and SSH keys, focusing on root and newly created high‑privilege accounts.

High : Review audit logs for namespace creation, module loads, and sudoers writes.

Medium : Check OVS module load records using dmesg and auditd.

Medium : Assess shared‑host risk; multi‑tenant environments are highest risk.

Layered Defense

Layer 1 (Recommended): Block module loading

echo 'install openvswitch /bin/false' > /etc/modprobe.d/ovswrap.conf

Using install replaces the modprobe call, preventing the kernel from loading the OVS module via any path, including request_module().

Layer 2 (Depth Defense): Disable unprivileged user namespaces

# RHEL/CentOS/AlmaLinux/Rocky/CloudLinux 9/10
sysctl -w user.max_user_namespaces=0
echo 'user.max_user_namespaces = 0' > /etc/sysctl.d/ovswrap.conf
# Ubuntu 22.04
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone = 0' > /etc/sysctl.d/ovswrap.conf

Note: On Ubuntu, apparmor_restrict_unprivileged_userns does not mitigate this issue.

Layer 3: Deploy upstream kernel patches

Patched upstream kernels: 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5

Cloud providers (Alibaba Cloud, Tencent Cloud) typically release fixes within 1‑2 weeks.

Live‑patch solutions (KernelCare, kpatch, livepatch) provide no‑reboot remediation.

After upgrading, remove temporary mitigations, e.g., rm /etc/modprobe.d/ovswrap.conf.

Detection Rules

Kernel module load monitoring :

-w /sbin/modprobe -p x -k modules
-w /bin/modprobe -p x -k modules

Syscall‑level namespace creation monitoring (watch for unshare with CLONE_NEWUSER or CLONE_NEWNET).

Sudoers integrity monitoring using AIDE, OSSEC, etc., on /etc/sudoers and /etc/sudoers.d/.

Kernel audit rule example :

# Monitor Open vSwitch module loads
-w /lib/modules/$(uname -r)/kernel/net/openvswitch/ -p wa -k ovs_module
# Monitor sudoers changes
-w /etc/sudoers -p wa -k sudoers_change
-w /etc/sudoers.d/ -p wa -k sudoers_change

Shared‑Host Scenario

In multi‑tenant servers, a compromised website can act as a local user, trigger the OVS module load via a generic Netlink probe, gain CAP_NET_ADMIN in a private namespace, exploit the overflow, and obtain root, allowing cross‑account data theft. Blocking the module or applying a hot‑patch stops the chain at step 2, limiting impact to the single compromised site.

Defender Reflections

Long‑standing bugs can become exploitable after seemingly benign changes; assume vulnerabilities exist and focus on detection and response.

Kernel‑level exploits are becoming easier; weaponized PoCs covering hundreds of kernels render “wait for patch” ineffective.

Depth‑in‑defense is essential: module blocking, namespace restriction, hot‑patches, and upstream patches together provide resilience even if one layer fails.

Conclusion

OVSwrap (CVE‑2026‑64531) is one of the most widely affecting and lowest‑barrier local privilege escalation bugs in recent Linux kernel history. It exploits a 13‑year‑old defect that became weaponized after a 2025 code change. Any unprivileged local user can gain root on over 20 major distributions, and the publicly released PoC spans ~800 x86‑64 kernels. Immediate actions are to block the OVS module, disable unprivileged namespaces, and deploy upstream or vendor patches; layered defenses keep risk manageable until permanent fixes are in place.

References

New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch – The Hacker News (2026‑08‑05)

OVSwrap (CVE‑2026‑64531) Mitigation Advisory – CloudLinux (2026‑08‑04)

OVSwrap Technical Write‑up – Asim Manizada

Public Proof‑of‑Concept – GitHub

Upstream Fix Commit 3f1f75536668 – Linux Kernel