Harish Kumar 
A newly disclosed Linux kernel flaw, dubbed OVSwrap and tracked as CVE-2026-64531, shows how a single unchecked integer can undo years of container and namespace hardening.
Researcher Asim Viladi Oglu Manizada disclosed the bug on July 28, 2026, alongside a working proof-of-concept covering roughly 800 kernel builds, and the takeaway for defenders is blunt: on a wide swath of default Linux installs, an ordinary local user can become root without touching a running Open vSwitch bridge or holding any host-level privilege.
OVSwrap lives in the Linux kernel’s Open vSwitch (OVS) datapath, the in-kernel component that executes network flows defined by userspace. OVS actions submitted via Generic Netlink get validated and rewritten into an internal representation stored as Netlink attributes, whose length field (nla_len) is only 16 bits wide, capping any single attribute at 65,535 bytes.
OVSwrap Flaw (CVE-2026-64531)
The code that finalized a nested action’s length never actually verified that it fit within that field, a gap that has existed since 2013. It stayed dormant because a separate 32 KiB ceiling on the total generated action stream indirectly prevented any nested attribute from reaching the wraparound point.
That safety net was removed in March 2025 to fix unrelated build failures, unintentionally reactivating the 13-year-old truncation bug. An attacker can now submit a CLONE action-packed with hundreds of small contract sub-actions; on x86-64, each expands to 164 bytes internally, pushing the generated attribute past the 65,536-byte boundary.
The stored length silently wraps to a small number, and later kernel code flow dumps and teardown trusts that wrapped value and resumes parsing from the middle of attacker-controlled conntrack data instead of the action’s real end.
Because conntrack labels and timeout names are attacker-controlled, forged action headers can be planted exactly where the corrupted parser lands.
Manizada’s PoC chains this into three primitives: a fake OUTPUT action that leaks a real kernel pointer (via the FTP conntrack helper), a forged tunnel SET action that turns into an arbitrary kernel-memory read, and the teardown path’s dst_release() call turned into a constrained decrement primitive.
Chaining the read primitive locates a target process’s credential structure in kernel memory; the decrement primitive then walks fsuid/fsgid down to zero, or on older kernels wraps a capability field to grant full privileges. The corrupted process then quietly rewrites /etc/sudoers handing the attacker root.
What makes this notable is reliability without heap grooming. Because the pointer and struct offsets are static per exact kernel build, they can be derived once from System.map, kallsyms, or BTF data, which is precisely why the PoC ships precomputed offsets for hundreds of builds rather than deriving them at runtime.
Exploitation needs no pre-existing OVS bridge or running ovs-vswitchd just CAP_NET_ADMIN inside a network namespace, which an unprivileged user can obtain via a plain unshare -Urn on distros that ship OVS as a loadable module and allow unprivileged user namespaces.
Confirmed exploitable-by-default systems include Ubuntu 22.04/24.04, Debian 12/13, Fedora 42–44, Arch Linux, AlmaLinux, Rocky Linux, CentOS Stream, Kali Linux, and NixOS; some others (Ubuntu 26.04, Oracle Linux) require minor config tweaks, while older kernels lacking the March 2025 change remain unaffected.
Upstream fixes landed in kernels 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5 via commit 3f1f75536668, following coordinated disclosure with linux-distros.
Where immediate patching isn’t possible, blacklist the openvswitch module if unused, disable unprivileged user namespaces, or deploy the researcher’s emergency BPF-based guard. Given the public PoC’s scale, treat this as an urgent priority for any cloud, container, or SDN host running OVS.
About the Author
Kiran 
