← News
/DISPATCH · 2026-08-07

CVE-2026-64531 "OVSwrap": Linux Kernel Open vSwitch Local Privilege Escalation Alert; PoC and 800 Payloads Public

Linux kernel Open vSwitch local privilege escalation CVE-2026-64531 (CVSS 7.8) has a public PoC and ~800 kernel-build exploit payloads. Unprivileged users can obtain root in one shot. Affects AlmaLinux, Ubuntu, Debian, RHEL, Rocky, and other major distros; shared-hosting impact is severe.

CVE-2026-64531 OVSwrap is a high-severity Linux kernel Open vSwitch datapath local privilege escalation disclosed on 2026-07-28 by researcher Asim Manizada, CVSS 3.1 score 7.8. Any local unprivileged user on an affected host can obtain root in one shot. PoC and ~800 precompiled exploit payloads for kernel builds are public. Cloud, virtualization, and shared-hosting operators should treat this as urgent.

Incident overview

Open vSwitch (OVS) is the most common in-kernel virtual switch in cloud platforms and SDN. `openvswitch.ko` typically ships as a loadable module with major distros. The researcher nested oversized Open vSwitch actions to trigger 16-bit truncation of the Netlink attribute `nla_len` field, then used misaligned parsing to obtain a kernel pointer leak, kernel read, and targeted 32-bit decrement primitive, corrupted host-process credentials, and wrote `/etc/sudoers.d` rules for root code execution. The issue was amplified after a 2025-03 upstream change removed the 32 KiB total action-flow cap. PoC and technical details are public.

Technical details

The bug is a missing nested-action length bounds check in the kernel datapath. The attacker stuffs hundreds of `conntrack` nested actions inside a `CLONE` action. On x86-64 each nested action expands to ~164 bytes; once the total exceeds 65,535 bytes the 16-bit length field wraps to a tiny value. Later code trusts that wrapped length and continues parsing attacker-controlled data, yielding:

These primitives land at determined offsets in one contiguous buffer, so no heap grooming is required. The chain decrements `fsuid`/`fsgid` in `cred` to 0, writes `/etc/sudoers.d` for persistence, and drops a root shell. PoC requires OVS conntrack support, the FTP conntrack helper, and `sudo`. In containers, the container namespace only needs `CAP_NET_ADMIN`.

Impact

Confirmed exploitable under default config: AlmaLinux 9/10, Alpine 3.22~3.24, Amazon Linux 2023, Arch, CentOS Stream 9/10, Debian 12/13, Fedora 40~44, Gentoo, Kali 2026.1, Linux Mint 22.3, NixOS, openSUSE Tumbleweed, Pop!_OS, Rocky Linux, Ubuntu 22.04/24.04. Upstream fix commit `3f1f755366687d` is merged in 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5; 6.13/6.14~6.17/6.19/7.0 and other EOL branches get no official fix. In-the-wild use is unconfirmed, but the public PoC plus 800 precompiled payloads makes the weaponization window very short. On shared hosting / VPS, one compromised website account can take the entire server to root.

Mitigation

References