New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch
A memory corruption flaw in the Linux kernel's Open vSwitch datapath gives ordinary local users a path to root on a broad set of default-configured distributions, and a public exploit ships with pre-built records for roughly 800 kernel builds.
Intelligence analysis by Llama
A security researcher discovered a memory corruption flaw in the Linux kernel's Open vSwitch datapath, allowing local users to gain root access on default-configured distributions. A public exploit has been released with pre-built records for 800 kernel builds.
Imagine a bug in the Linux kernel that lets a regular user become the superuser on a computer. This bug is like a backdoor that allows an attacker to gain root access, which can lead to severe consequences, including data breaches and system compromise.
Analysis
A 13-Year-Old Bug Bites Back
The vulnerability, tracked as CVE-2026-64531 (CVSS score: 7.8) and codenamed OVSwrap by its discoverer, was disclosed by security researcher Asim Manizada on July 28, 2026. The bug sits in the kernel datapath, not the userspace ovs-vswitchd daemon. In a technical write-up, Manizada said an attacker needs 'no existing OVS bridge, no running ovs-vswitchd, no host-level CAP_NET_ADMIN.'
How the Bug Works
On affected systems where the OVS kernel datapath is available and unprivileged user namespaces are enabled, an ordinary user can create private user and network namespaces with unshare -Urn, gain CAP_NET_ADMIN inside that namespace, and reach the vulnerable flow-installation path. If the openvswitch module is installed but not loaded, resolving its Generic Netlink family name can load it automatically. An empty lsmod output does not mean a system is safe.
The Fix
The upstream fix shipped in stable trees on July 24. Where a patched vendor kernel is not yet available, and Open vSwitch is not required, block future module loads; if the module is already resident, unload it or reboot. Manizada said he reported the issue to security@kernel.org and the OVS maintainers on June 19. The first fixed upstream releases are Linux 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. The end-of-life 6.13 through 6.17, 6.19, and 7.0 series will not receive upstream stable fixes.
Key points
- A memory corruption flaw in the Linux kernel's Open vSwitch datapath gives ordinary local users a path to root on a broad set of default-configured distributions.
- A public exploit has been released with pre-built records for roughly 800 kernel builds.
- The vulnerability affects a broad set of default-configured distributions, making it a significant security concern.
- Local users can gain root access, which can lead to severe consequences, including data breaches and system compromise.
If this vulnerability is patched quickly, the impact will be minimal, and users will be able to update their systems without significant disruption. Additionally, the release of a public exploit may encourage more researchers to work on finding and fixing similar vulnerabilities.
If the vulnerability is not patched quickly, it could lead to widespread exploitation, resulting in significant data breaches and system compromises. Additionally, the release of a public exploit may make it easier for attackers to find and exploit similar vulnerabilities.
