A flaw in the Linux kernel’s Open vSwitch datapath allows unprivileged local users to escalate to root on many stock distributions. Dubbed OVSwrap and tracked as CVE-2026-64531 with a CVSS score of 7.8, it was documented by researcher Asim Manizada, who says exploitation requires no existing OVS bridge, no ovs-vswitchd daemon, and no CAP_NET_ADMIN on the host.
The bug is a 13-year-old truncation issue in the datapath. A March 2025 commit removed a 32 KiB cap on generated flow actions, unmasking it. An oversized nested action overflows the 16-bit nla_len field, and parsing then resumes inside attacker-controlled conntrack data. Manizada describes the corruption as highly reliable, with no heap grooming required.
Systems that enable unprivileged user namespaces let a standard account issue unshare -Urn, create its own user and network namespaces, collect CAP_NET_ADMIN inside them, and then reach the flawed flow-installation routine. The public exploit chains three primitives: a kernel pointer leak via a fake OUTPUT action, an arbitrary read through a forged tunnel SET action, and a targeted decrement that zeroes fsuid and fsgid. The demo is destructive by design and only runs where OVS conntrack support, the FTP conntrack helper, and sudo are present.
The fix reached stable trees on July 24, with first patched releases at Linux 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. Where vendor kernels lag, administrators can block future loads of the openvswitch module or unload it if resident. Manizada warns that an empty lsmod output is not proof of safety, because resolving the Generic Netlink family name can trigger an automatic module load.
