Summary Points
- An unauthenticated local user can exploit CVE-2026-64531 in Linux’s Open vSwitch to achieve root privileges, potentially leading to complete system compromise.
- The vulnerability arises from a buffer wraparound in flow action memory, enabling attackers to leak kernel pointers, perform arbitrary kernel reads, and escalate privileges.
- Exploitation can be blocked by applying kernel patches, unloading the openvswitch module, or disabling unprivileged user namespaces; failure to do so risks privilege escalation in shared environments.
Threat, Attack Techniques, and Targets
The vulnerability, named CVE-2026-64531 and called OVSwrap, allows local users to gain root access on affected Linux systems. It is a memory corruption flaw in the Linux kernel’s Open vSwitch (OVS) datapath. An attacker can exploit this flaw without needing a running OVS bridge or daemon. They only need to create private user and network namespaces with unshare, gain CAP_NET_ADMIN inside these namespaces, and then reach the vulnerable flow-installation path.
The attack involves submitting a CLONE action with hundreds of conntrack sub-actions. When processed, this pushes the nested attribute size past 65,535 bytes. The kernel then wraps the length value, which causes the kernel to trust and parse forged data. This leads to memory corruption. An exploit then uses this corruption to leak pointers, read kernel memory, and modify credentials. The result can be a full root access with a crafted exploit.
The threat targets Linux distributions where the Open vSwitch kernel module is available, especially those with unprivileged user namespace enabled. The attack is effective on systems like AlmaLinux, Alpine, Amazon Linux, Arch, CentOS, Debian, Fedora, Gentoo, Kali, Linux Mint, NixOS, openSUSE, Pop!_OS, Rocky Linux, and Ubuntu, among others.
Impact, Security Implications, and Remediation Guidance
This flaw poses a serious security risk. A successful attack can lead to root access, allowing an attacker to take complete control of the system. They could modify critical files, install malicious software, or use the system for further attacks. It also exposes kernel memory, which could be used to gather sensitive information.
The flaw is especially dangerous in environments where multiple users share the same host. An attacker who already compromised one account could escalate privileges to root. Containers or processes with CAP_NET_ADMIN over attacker-controlled namespaces are also at risk.
For remediation, it is best to install a patched kernel if available. Developers have released fixes in certain upstream kernel versions, such as Linux 5.15.212 and later. If a patch is not available, users should block the Open vSwitch module from loading by creating a configuration file, for example:
echo 'install openvswitch /bin/false' > /etc/modprobe.d/ovswrap.conf.
This prevents future loads. If the module is already loaded, it must be unloaded or the system rebooted. Disabling unprivileged user namespaces can also reduce risk.
However, for detailed remediation guidance and updates, it is recommended to consult the vendor or relevant security authorities.
Discover More Technology Insights
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
