OVSwrap: A 13-Year Linux Kernel Bug Becomes Privilege Escalation

On July 28, 2026, Asim Manizada published the full disclosure of CVE-2026-64531, dubbed OVSwrap, on oss-security: a memory-corruption vulnerability in the Open vSwitch kernel datapath that allows a local unprivileged user to gain root privileges. The bug lay dormant for 13 years until a March 2025 maintenance commit removed a 32 KiB safety cap on OVS actions, making it exploitable in default configurations across dozens of enterprise distributions. A public proof-of-concept exploit includes pre-built records for roughly 800 x86-64 kernel builds and requires no running Open vSwitch, configured bridges, or initial CAP_NET_ADMIN.

{"main_topic":"cybersecurity","topics":["cybersecurity","vulnerability","cve","linux","exploit","privilege-escalation","open-source"]}

Key Takeaways

Researcher Asim Manizada disclosed CVE-2026-64531 on July 28, 2026, a vulnerability in the Open vSwitch kernel datapath that enables local privilege escalation to root via a 16-bit field wraparound.
A March 2025 commit removed a 32 KiB cap on OVS actions, exposing a latent bug that had existed for 13 years and making it exploitable in default configurations across dozens of distributions.
The public proof-of-concept exploit includes pre-built records for approximately 800 x86-64 kernel builds and requires no running Open vSwitch, configured bridges, or initial CAP_NET_ADMIN.
CloudLinux confirmed that CageFS does not block the attack: on multi-user servers, a single site compromised via an independent vulnerability can be escalated to root on the entire host.

On July 28, 2026, Asim Manizada published the full disclosure of CVE-2026-64531 on oss-security, dubbed OVSwrap: a memory-corruption vulnerability in the Open vSwitch kernel datapath that allows a local unprivileged user to obtain root privileges. The bug existed in a dormant state for 13 years but became exploitable only in March 2025, when a maintenance commit removed a reliability check that had masked its danger. The proof-of-concept exploit is public and works in default configurations on dozens of enterprise distributions.

How the nla_len Wraparound Works

The mechanism nests in the parsing of nested Netlink attributes within the Open vSwitch kernel datapath. The nla_len field measuring the length of nested attributes is an unsigned 16-bit integer with a maximum limit of 65,535 bytes. When a CLONE action contains hundreds of conntrack sub-actions, each expanded to 164 bytes on x86-64, the sum exceeds this limit. The truncated value causes a wraparound: the parser resumes at an attacker-controlled offset, interpreting forged data as legitimate OVS actions.

Manizada chained three precise primitives to avoid complex heap-grooming techniques, exploiting the deterministic nature of the contiguous buffer: a kernel pointer leak via a fake OUTPUT, an arbitrary read via a forged tunnel SET, and finally a targeted decrement on kernel credentials via tun_dst teardown. The chain executes reliably, with what the researcher describes as "logic-bug-grade reliability" according to The Hacker News.

The Commit That Turned a Bug Into a Weapon

Commit a1e64addf3ff, dated March 2025 and titled "net: openvswitch: remove misbehaving actions length check", eliminated a 32 KiB cap on the action stream that had been introduced to handle failures in OpenStack environments. The change aimed to improve operational robustness: with the cap, complex packets were dropped, generating errors. Without the cap, those same packets traverse the system and trigger the wraparound.

This dynamic illustrates a systemic tension between reliability engineering and security assessment. Robustness optimizations introduced without threat-model analysis can expose latent primitives that, while existing for years, become weapons only when the operational context changes. The Linux kernel received the fix on July 24, 2026 via commit 3f1f75536668 ("net: openvswitch: reject oversized nested action attrs"), but the patched stable releases — 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5 — have yet to propagate into individual distribution repositories.

The Exposure Matrix: Who Is Affected

According to the original disclosure and The Hacker News reconstructions, the exploit has been successfully tested on a wide range of distributions: AlmaLinux 9/10, Alpine 3.22-3.24, Amazon Linux 2023, Arch, CentOS Stream 9/10, Debian 12/13, Fedora 42-44, Gentoo, Kali 2026.1, Linux Mint 22.3, NixOS, openSUSE Tumbleweed, Pop!_OS, Rocky Linux 9/10, and Ubuntu 22.04. Ubuntu 24.04 is exploitable via an aa-exec fallback; Ubuntu 26.04 is blocked in stock configuration but becomes vulnerable if apparmor_restrict_unprivileged_userns is disabled. Systems with older kernels — Amazon Linux 2, Debian 11, Rocky Linux 8, Ubuntu 20.04 — are not affected because they predate the enabling commit.

"no existing OVS bridge, no running ovs-vswitchd, no host-level CAP_NET_ADMIN"

Manizada's PoC requires no running Open vSwitch, configured bridges, or initial network capabilities. The only prerequisites are: the openvswitch module present on the system, active conntrack/FTP helper support, and sudo installed. This drastically lowers the attack surface: an unprivileged user who gains code execution via any independent vulnerability — an outdated plugin on a shared server — can escalate to root without interacting with the existing network configuration.

Countermeasures and Their Limits

The emergency mitigation documented by CloudLinux is a module blocklist via echo 'install openvswitch /bin/false' > /etc/modprobe.d/ovswrap.conf, which however breaks OpenStack and Kubernetes stacks that depend on Open vSwitch for SDN networking. This creates an immediate operational tension: protect security or maintain cluster functionality.

Some standard precautions prove ineffective. According to the researcher, "An empty lsmod output does not mean a system is safe": the openvswitch module can auto-load via Generic Netlink family name resolution even if not present in memory. CloudLinux confirmed that CageFS, its filesystem isolation mechanism, "does not restrict the netlink call that triggers the module load". AppArmor and SELinux do not block the exploit once CAP_NET_ADMIN is obtained.

Disabling unprivileged user namespaces — a measure recommended in various kernel security advisories — interrupts the ordinary attack path but not the container path with CAP_NET_ADMIN, which Manizada described as theoretically reachable but did not demonstrate in the released PoC.

What to Do Now

For system administrators managing multi-user infrastructure or shared hosting, priority actions derive directly from available sources:

Verify module status: run lsmod | grep openvswitch but consider that empty output does not guarantee protection, given the auto-load mechanism via Generic Netlink.
Apply modprobe blocklist if OVS functionality is not needed: create /etc/modprobe.d/ovswrap.conf with the blocklist directive documented by CloudLinux, aware that this disables virtualized networking components.
Plan kernel upgrade: patched versions are available upstream; for CloudLinux 9/10 and Ubuntu 22.04, the KernelCare livepatch has been available since July 30, 2026, requiring an active license.
Monitor vendor channels for AlmaLinux/RHEL: CloudLinux indicates patched kernels are expected in AlmaLinux 9.9 and 10.3 streams or later, with no fixed date at time of writing.

Why This Case Matters Beyond the Single CVE

OVSwrap is not an isolated vulnerability but a case study in how reliability engineering can generate security debt. The March 2025 commit was technically correct: it removed behavior causing legitimate failures in OpenStack. But removing the cap shifted the operational boundary into a zone where a 13-year-old integer-arithmetic bug became exercisable.

The concrete risk concentrates on multi-user servers: as CloudLinux documented, "one compromised website on a shared server becomes root on the whole server", and "Local here does not mean an employee or a customer you trust. On a shared server, the local user is whoever just got into one of the sites you host through an outdated plugin". The public exploit PoC, with its roughly 800 pre-built kernel records, makes this escalation a reproducible event rather than a theory.

No confirmation of active in-the-wild exploitation emerges, but the public availability of the code and the simplicity of prerequisites reduce the exposure window. The brief does not specify whether non-x86-64 architectural variants exist or whether the openvswitch module can be compiled built-in in certain kernel configurations, circumstances that would render the modprobe mitigation ineffective.

Information verified against cited sources and current as of publication.

Sources

Sources and references