A flaw in the Linux kernel’s Open vSwitch datapath allows unprivileged local users to escalate to root on many stock distributions. Dubbed OVSwrap and tracked as CVE-2026-64531 with a CVSS score of 7.8, it was documented by researcher Asim Manizada, who says exploitation requires no existing OVS bridge, no ovs-vswitchd daemon, and no CAP_NET_ADMIN on the host.
The bug is a 13-year-old truncation issue in the datapath. A March 2025 commit removed a 32 KiB cap on generated flow actions, unmasking it. An oversized nested action overflows the 16-bit nla_len field, and parsing then resumes inside attacker-controlled conntrack data. Manizada describes the corruption as highly reliable, with no heap grooming required.
Systems that enable unprivileged user namespaces let a standard account issue unshare -Urn, create its own user and network namespaces, collect CAP_NET_ADMIN inside them, and then reach the flawed flow-installation routine. The released exploit strings together three primitives: leaking a kernel pointer with a bogus OUTPUT action, reading memory arbitrarily through a fabricated tunnel SET action, and a precise decrement that clears fsuid and fsgid. The demo is destructive by design and only runs where OVS conntrack support, the FTP conntrack helper, and sudo are present.
Stable trees picked up the fix on July 24, beginning with Linux 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. Where vendor kernels lag, administrators can block future loads of the openvswitch module or unload it if resident. Manizada warns that an empty lsmod output is not proof of safety, because resolving the Generic Netlink family name can trigger an automatic module load.
