Full Report
A memory corruption flaw in the Linux kernel's Open vSwitch datapath gives ordinary local users a path to root on a broad set of default-configured distributions, and a public exploit ships with pre-built records for roughly 800 kernel builds. The vulnerability, tracked as CVE-2026-64531 (CVSS score: 7.8) and codenamed OVSwrap by its discoverer, was disclosed by security researcher Asim
Analysis Summary
# Vulnerability: OVSwrap Linux Kernel Privilege Escalation
## CVE Details
- **CVE ID:** CVE-2026-64531
- **CVSS Score:** 7.8 (High)
- **CWE:** CWE-190 (Integer Overflow or Wraparound) / CWE-122 (Heap-based Buffer Overflow)
## Affected Systems
- **Products:** Linux Kernel (specifically the Open vSwitch datapath module).
- **Versions:**
- Vulnerable: Versions 6.13 through 6.17, 6.19, and 7.0 (Note: These series are reported as not receiving upstream stable fixes).
- Fixed Upstream: 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5.
- **Configurations:** Systems where the `openvswitch` kernel module is available (even if not currently loaded) and unprivileged user namespaces are enabled. Reachability is possible via `unshare -Urn`.
## Vulnerability Description
The flaw exists in the Linux kernel's Open vSwitch (OVS) datapath. OVS stores flow actions as Netlink attributes using a 16-bit `nla_len` field, which caps nested attributes at 65,535 bytes. While this limit existed for years, a March 2025 change removed a 32 KiB total cap on action streams. An attacker can now submit a `CLONE` action containing many `conntrack` sub-actions that, when expanded by the kernel, exceed the 16-bit limit. This causes the length field to wrap around (integer overflow), leading the kernel to misparse the buffer and execute attacker-controlled data as valid OVS actions.
## Exploitation
- **Status:** PoC available (Publicly released with records for ~800 kernel builds).
- **Complexity:** Medium (Requires chaining multiple primitives: pointer leak, arbitrary read, and targeted decrement).
- **Attack Vector:** Local
## Impact
- **Confidentiality:** High (Full system access/Root).
- **Integrity:** High (Ability to modify system files like `/etc/sudoers`).
- **Availability:** High (Exploit is destructive and can cause kernel instability).
## Remediation
### Patches
- Update to the following Linux stable releases (or later): 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5.
- Users should prioritize vendor-specific updates (e.g., Ubuntu, RHEL, Debian) as they may backport fixes to different versioning schemes.
### Workarounds
- **Disable Unprivileged User Namespaces:** Set `kernel.unprivileged_userns_clone = 0` via sysctl if not required.
- **Block Module Loading:** If Open vSwitch is not needed, blacklist the `openvswitch` module to prevent it from being loaded automatically.
- **Unload Module:** If the module is already loaded and not in use, unload it using `modprobe -r openvswitch`.
## Detection
- **Indicators of Compromise:**
- Unexpected modifications to `/etc/sudoers` or files in `/etc/sudoers.d/`.
- Presence of unusual OVS bridges or FTP conntrack helpers.
- Systematic kernel crashes or "zombie" OVS processes.
- **Detection Methods:** Monitor for the use of `unshare` by unprivileged users and audit kernel module loading events.
## References
- **Upstream Fix:** hxxps[://]github[.]com/torvalds/linux/commit/3f1f755366687d051174739fb99f7d560202f60b
- **Researcher Write-up:** hxxps[://]heyitsas[.]im/posts/ovswrap/
- **PoC Repository:** hxxps[://]github[.]com/manizada/OVSwrap