OVSwrap vulnerability allows local privilege escalation on Linux

As reported by Security Affairs, a 13-year-old Linux kernel flaw named OVSwrap was disclosed, enabling local users to gain root privileges on many default-configured distributions utilizing Open vSwitch. The vulnerability, tracked as CVE-2026-64531 with a CVSS score of 7.8, was made public with a proof-of-concept exploit.

The OVSwrap vulnerability stems from an unsafe assignment in Open vSwitch's handling of Netlink attributes, where a 16-bit length field for internal actions could be manipulated to exceed its intended limit. This was exacerbated by a recent change that removed a 32 KiB cap on the total generated action stream, making the previously unexploitable bug reachable. An attacker can craft a malicious action that, when processed, causes a length field to wrap around, leading to memory corruption and allowing arbitrary kernel reads and writes. The exploit chains these primitives to leak kernel pointers, bypass protections, and ultimately elevate privileges to root. Crucially, exploitation requires minimal privileges, such as CAP_NET_ADMIN within a user namespace, which is often enabled by default on many popular Linux distributions. This broad reachability makes it a significant threat, impacting systems like AlmaLinux, Debian, Fedora, Ubuntu, and others. Users are advised to install patched vendor kernels or, as an interim measure, block the Open vSwitch module if not required.

Source: Security Affairs