OVSwrap Local Root Vulnerability (CVE-2026-64531): Exploit Details and PoC Publicly Disclosed

TL;DR

The OVSwrap local root flaw lets an unprivileged user gain root on many Linux systems. It affects the kernel’s Open vSwitch datapath and carries the ID CVE-2026-64531. Researcher Asim Manizada published the full write-up and a public proof-of-concept on July 28, 2026.

Why it matters

Open vSwitch ships on most Linux distributions as a loadable module. As a result, the attack surface reaches far past dedicated network hosts. An attacker needs no OVS bridge and no host-level admin rights.

Instead, they only need CAP_NET_ADMIN inside a namespace they control. On systems that allow unprivileged user namespaces by default, a plain user can create one. Therefore many stock installs are exposed. The author also flags a possible container path, though he did not confirm an escape.

How the attack works

Open vSwitch stores generated flow actions as Netlink attributes. Each attribute records its length in a 16-bit field. That field caps a single nested action at 65,535 bytes.

A March 2025 change removed an older 32 KiB limit on the total action stream. Consequently, a crafted CLONE action packed with conntrack actions can grow past that ceiling. The stored length then wraps to a tiny value. Later code trusts the wrapped length and resumes parsing inside attacker-controlled data.

Because those bytes hold forged actions, the exploit builds a kernel read and a targeted decrement. It then rewrites a host process’s credentials to reach root. Notably, no memory grooming is needed, so the technique stays reliable.

Affected versions

The OVSwrap local root vulnerability reaches any pre-fix kernel that took the March 2025 change, directly or through backports. Upstream fixes landed in stable releases 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5.

Manizada tested a wide range of systems. Default-config exploitable distros include AlmaLinux, Alpine, Amazon Linux 2023, Arch, CentOS Stream, Debian 12/13, Fedora 42+, Kali 2026.1, Rocky, and Ubuntu 22.04/24.04. Meanwhile, several end-of-life kernel series get no upstream stable fix.

Treat this list as the researcher’s tested sample, not a full census.

Patch and mitigation

Install a kernel that carries the fix as soon as you can. If you cannot patch yet, a few steps cut the risk.

If you cannot patch

• Unload the openvswitch module and block it from loading when OVS is not needed.
• Disable unprivileged user namespaces to close the ordinary-user route.
• Apply the emergency BPF guard shipped alongside the proof-of-concept.

Exploitation status

This OVSwrap local root bug now ships with public exploit material, and the author released records for roughly 800 kernel builds. However, no in-the-wild exploitation has been confirmed so far. Even so, defenders should treat exposure checks as urgent.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.