CVE-2026-64531 "OVSwrap": Linux Kernel Open vSwitch LPE Advisory — PoC and 800 Payloads Public

Linux kernel Open vSwitch LPE CVE-2026-64531 (CVSS 7.8) has a public PoC and ~800 prebuilt kernel payloads. Unprivileged users get root in one shot. Hits AlmaLinux, Ubuntu, Debian, RHEL, Rocky, and other major distros. Shared-host risk is severe.

CVE-2026-64531 OVSwrap is a high-severity Linux kernel Open vSwitch datapath local privilege escalation disclosed 2026-07-28 by researcher Asim Manizada. CVSS 3.1: 7.8. Any local unprivileged user can obtain root on an affected host in one shot. PoC and ~800 precompiled payloads covering kernel builds are public. Treat cloud, virtualization, and shared-host assets as urgent.

Overview

Open vSwitch (OVS) is the most common in-kernel virtual switch in cloud and SDN. `openvswitch.ko` ships as a loadable module with major distros. The researcher nested oversized Open vSwitch actions to truncate the Netlink `nla_len` field to 16 bits, then used misaligned parsing for a kernel pointer leak, kernel read, and targeted 32-bit decrement. That breaks host process credentials and writes `/etc/sudoers.d` rules for root code execution. The issue grew after a 2025-03 upstream change dropped the 32 KiB total action-flow cap. PoC and technical details are public.

Technical Details

Root cause: missing nested-action length bounds checks in the kernel datapath. Attacker stuffs a `CLONE` action with hundreds of `conntrack` sub-actions. On x86-64 each sub-action expands to ~164 bytes. Past 65,535 bytes the 16-bit length field wraps to a tiny value. Later code trusts the wrapped length and keeps parsing attacker-controlled data, yielding:

• Kernel pointer leak via forged `OUTPUT` action
• Arbitrary kernel read via forged `SET` tunnel action
• Targeted 32-bit decrement by destroying a forged `tun_dst` pointer

Landing sites sit in the same contiguous buffer, so no heap grooming is required. The chain decrements `cred` `fsuid`/`fsgid` to 0, writes `/etc/sudoers.d` for persistence, and drops a root shell. PoC needs OVS conntrack, the FTP conntrack helper, and `sudo`. In containers, the namespace only needs `CAP_NET_ADMIN`.

Impact

Confirmed exploitable on default configs: AlmaLinux 9/10, Alpine 3.22~3.24, Amazon Linux 2023, Arch, CentOS Stream 9/10, Debian 12/13, Fedora 40~44, Gentoo, Kali 2026.1, Linux Mint 22.3, NixOS, openSUSE Tumbleweed, Pop!_OS, Rocky Linux, Ubuntu 22.04/24.04. Upstream fix commit `3f1f755366687d` landed in 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5. EOL branches 6.13/6.14~6.17/6.19/7.0 get no official fix. No in-the-wild use confirmed, but the public PoC plus 800 prebuilt payloads make the weaponization window tiny. On shared/VPS hosts, one compromised site account can take the whole server to root.

Remediation

• Kernel upgrade: move to a fixed kernel on your branch (5.15.212 / 6.1.178 / 6.6.145 / 6.12.97 / 6.18.40 / 7.1.5), or the vendor backport.
• Temporary mitigation: if you don't need OVS, `echo 'install openvswitch /bin/false' > /etc/modprobe.d/ovswrap.conf` then `modprobe -r openvswitch` or reboot. Unload if already loaded.
• Block namespace path: `sysctl kernel.unprivileged_userns_clone=0`, set `/proc/sys/user/max_user_namespaces` to 0. Stops unprivileged user namespaces.
• Livepatch: KernelCare/TuxCare users run `kcarectl --patch-info | grep CVE-2026-64531` to check if a rebootless patch is ready.
• Emergency BPF: BPF hotfix shipped with the PoC intercepts the conntrack action abuse sequence. Use as a pre-patch shield.
• Detection: watch unexpected writes to `/etc/sudoers` and `/etc/sudoers.d/`. auditd: flag sessions that `unshare -Urn` then immediately load `openvswitch`.

References

• OVSwrap technical writeup (Asim Manizada)
• OVSwrap PoC repo (800+ kernel builds)
• oss-security 2026/08/01 advisory
• Kernel fix commit 3f1f755366687d
• The Hacker News coverage
• CloudLinux official mitigation guide