New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch
CVE-2026-64531 (OVSwrap) is a memory corruption flaw in the Linux kernel's Open vSwitch datapath that allows unprivileged local users to escalate to root on broadly configured distributions The bug stems from a 16-bit nla_len overflow: a March 2025 change removed a 32 KiB cap on generated action streams, exposing a 13-year-old truncation bug that enables deterministic buffer wraparound A public PoC with pre-built records for ~800 x86-64 kernel builds chains three primitives (kernel pointer leak,
Analysis
TL;DR
- CVE-2026-64531 (OVSwrap) is a memory corruption flaw in the Linux kernel's Open vSwitch datapath that allows unprivileged local users to escalate to root on broadly configured distributions
- The bug stems from a 16-bit nla_len overflow: a March 2025 change removed a 32 KiB cap on generated action streams, exposing a 13-year-old truncation bug that enables deterministic buffer wraparound
- A public PoC with pre-built records for ~800 x86-64 kernel builds chains three primitives (kernel pointer leak, arbitrary kernel read, targeted decrement) to zero out fsuid/fsgid
- The upstream fix shipped July 24 across Linux 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5; EOL series will not receive patches
- Exploitation requires no existing OVS bridge, no running ovs-vswitchd, and no host-level CAP_NET_ADMIN—only an installed openvswitch module and unprivileged user namespaces
Why It Matters
This vulnerability demonstrates how a long-standing kernel logic bug, dormant for 13 years, can be weaponized by a single reliability-focused upstream change that overlooked security implications—a pattern increasingly common as kernel codebases grow in complexity. For AI practitioners and infrastructure teams, it underscores the critical risk of shared-host multi-tenant environments where a compromise of one workload can chain through OVSwrap into full root access, and it highlights the importance of monitoring vendor-specific kernel trackers rather than relying solely on upstream version numbers.
Technical Details
- Root cause: Open vSwitch stores flow actions as Netlink attributes with a 16-bit
nla_lenfield (max 65,535 bytes). An attacker crafts aCLONEaction containing hundreds of conntrack sub-actions; on x86-64 each expands to 164 bytes, exceeding the 16-bit limit and causing the length to wrap around. Subsequent parsing resumes from attacker-controlled data within the same contiguous buffer, enabling arbitrary memory corruption without heap grooming. - Enabling change: A March 2025 commit removed a 32 KiB cap on the total generated action stream to fix unpredictable failures in large OpenStack deployments. The review discussed reliability but did not address the security consequence of exposing the older truncation bug.
- Exploit chain: Three primitives derived from the wraparound—a kernel pointer leak via a fake
OUTPUTaction, an arbitrary kernel read via a forged tunnelSETaction, and a targeted decrement via teardown of a forgedtun_dstpointer—are chained to locate a host process's credentials and decrementfsuid/fsgidto zero on modern kernels. - Attack prerequisites: The
openvswitchmodule must be installable (auto-loads on Generic Netlink family resolution;lsmodmay show it as unloaded), unprivileged user namespaces must be enabled, and the PoC additionally requires OVS conntrack support, the FTP conntrack helper, andsudo. - Affected and unaffected systems: Default-config exploitation confirmed on AlmaLinux 9/10, Alpine 3.22–3.24, Amazon Linux 2023, Arch, CentOS Stream 9/10, Debian 12/13, Fedora 42–44, Gentoo, Kali 2026.1, Linux Mint 22.3, NixOS, openSUSE Tumbleweed, Pop!_OS, Rocky Linux 9/10, and Ubuntu 22.04. Ubuntu 24.04 is partially mitigated by AppArmor but bypassable via
aa-exec -p trinity. Older systems (Amazon Linux 2, Debian 11, Rocky Linux 8, Ubuntu 20.04) retained older code paths and were not exploitable through this route.
Industry Insight
- Multi-tenant host hardening is now a priority: In cloud and shared-hosting environments, OVSwrap transforms a low-privilege compromise into full root. Operators should audit Open vSwitch module usage and disable unprivileged user namespaces where feasible, or apply the emergency BPF guard for environments requiring both features.
- Vendor trackers trump upstream versions: Distribution kernels carry backports and downstream changes, so relying on upstream fix numbers alone is insufficient. Teams should monitor vendor-specific security advisories and apply patched kernels promptly, especially for EOL series that will not receive upstream fixes.
- Security review gaps in reliability patches: The March 2025 change that enabled this exploit was motivated by legitimate reliability concerns in large deployments. This reinforces the need for security-focused review checkpoints when removing defensive bounds (caps, limits) in kernel code, particularly in network subsystems with long code histories.
Disclaimer: The above content is generated by AI and is for reference only.