A newly disclosed Linux kernel privilege escalation vulnerability, CVE-2026-64531, dubbed OVSwrap, allows unprivileged local users to gain root privileges on a wide range of Linux distributions. The flaw resides in the Open vSwitch (OVS) kernel datapath, a networking component widely deployed in cloud, container, and virtualization environments. The vulnerability was discovered by Researcher using an experimental research technique that combines large language models (LLMs) with structured memory-geometry visualizations to analyze complex kernel memory behavior. Although the vulnerable code had existed for approximately 13 years, it only became practically exploitable after a kernel change introduced in 2025 removed an earlier size restriction.

The vulnerability stems from improper validation of nested Netlink attributes used by Open vSwitch to process network actions. While the kernel allows the overall action stream to exceed 64 KiB, it failed to ensure that individual nested actions remained within the 16-bit length field limit (65,535 bytes). By crafting an oversized nested action, such as a CLONE containing numerous conntrack actions, an attacker can trigger an integer wraparound, causing the stored length value to reset to a much smaller number. As a result, the kernel parser resumes processing from attacker-controlled data instead of the legitimate end of the action, enabling forged actions to be interpreted as valid. Because attacker-controlled conntrack fields make the offset predictable, exploitation is highly reliable and does not require complex memory grooming.

A notable aspect of OVSwrap is its low exploitation barrier. Attackers do not need an existing Open vSwitch bridge, a running OVS daemon, or administrative privileges on the host. Instead, an unprivileged user can create isolated user and network namespaces using tools such as unshare -Urn, obtain CAP_NET_ADMIN within that namespace, and instantiate a private OVS datapath to reach the vulnerable code. Furthermore, because Open vSwitch is commonly distributed as an auto-loadable kernel module, the attack surface may exist even on systems where OVS has never been explicitly configured. Researchers also noted that the same technique could potentially be adapted for container escape scenarios. The flaw was confirmed to be exploitable on numerous mainstream Linux distributions, including Ubuntu, Debian, Fedora, AlmaLinux, Rocky Linux, Arch Linux, Kali Linux, Linux Mint, Amazon Linux, NixOS, and openSUSE Tumbleweed, although some distributions require minor configuration changes, while older kernel branches unaffected by the 2025 change remain immune.

The vulnerability was responsibly disclosed to the Linux kernel security team and Open vSwitch maintainers, resulting in patches being released in stable kernel versions 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. Organizations are strongly advised to upgrade to these patched kernel releases as the primary mitigation. For systems where immediate patching is not feasible, administrators should blacklist the openvswitch kernel module if it is not required, disable unprivileged user namespaces where operationally possible, and consider deploying the emergency BPF-based mitigation released alongside the public proof-of-concept. Prompt remediation is recommended to prevent local privilege escalation and reduce the risk of potential container escape attacks.