Full research report
New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch
Executive assessment
The evidence supports a kernel-level local privilege-escalation flaw introduced into broadly deployed stable kernels when a protective action-length cap was removed in 2025. The vulnerable boundary is reachable without a pre-existing Open vSwitch bridge or running userspace daemon when the kernel module is available and namespace policy grants the required capability inside a private network namespace. Public exploit code materially increases risk because it includes kernel-specific data and demonstrates root credential modification, although its prerequisites and destructive behaviour limit universality. Upstream, government and vendor records agree on the mechanism and remedy, but defenders must use their distribution's kernel tracker because downstream backports make version-only assessment unreliable. No evidence reviewed establishes current malicious exploitation, actor attribution or malware involvement.
What happened
Asim Manizada reported a Linux kernel Open vSwitch datapath vulnerability to kernel and Open vSwitch maintainers on 19 June 2026. The upstream correction reached stable trees on 24 July, and Manizada publicly disclosed CVE-2026-64531 with exploit code on 28 July; broader reporting followed on 5 August. The flaw permits local privilege escalation to root when an affected kernel, the necessary Open vSwitch and conntrack functionality, and a usable network namespace are present.
Affected scope
The weakness is in the Linux kernel Open vSwitch datapath rather than the userspace ovs-vswitchd service. The discoverer's testing found exploitable configurations across numerous current distribution releases, but exposure depends on downstream backports, presence or availability of openvswitch.ko and supporting conntrack functionality, and whether an unprivileged user can obtain CAP_NET_ADMIN inside a private network namespace. First fixed upstream releases are 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40 and 7.1.5; distribution advisories remain the correct authority for vendor kernels.
Technical assessment
Open vSwitch validates and expands userspace flow actions into nested Netlink attributes whose length field is 16 bits. A 2025 change allowed the total action stream to exceed 64 KiB but removed the remaining guard that had prevented an individual nested attribute from exceeding 65,535 bytes; truncation can consequently make later kernel processing interpret attacker-controlled bytes differently from the validated structure. The public exploit turns the resulting memory corruption into host credential modification and root access, but it requires local execution, reachable Open vSwitch and conntrack functionality, an attacker-controlled network namespace with CAP_NET_ADMIN, and additional host prerequisites.
Recommended defensive actions
- Patch affected systems with a vendor-confirmed fixed kernel or supported livepatch, then reboot where required and verify the running kernel rather than only the installed package.
- Inventory systems for affected vendor kernels and the presence of openvswitch.ko, including modules available for automatic loading even when absent from lsmod.
- Block the Open vSwitch kernel module from loading where Open vSwitch is unnecessary, and unload an already resident module or reboot after applying the block.
- Disable unprivileged user namespaces where operationally acceptable, while recognising that this does not protect containers or processes already granted CAP_NET_ADMIN over an attacker-controlled network namespace.
- Hunt for unauthorised changes in /etc/sudoers and /etc/sudoers.d, unfamiliar accounts or SSH keys, unexpected Open vSwitch module loading, and suspicious user or network namespace creation.
Uncertainties and evidence gaps
- No verified evidence of in-the-wild exploitation or an attributed threat actor was found; public exploit availability alone does not establish active exploitation.
- The discoverer's distribution matrix is non-exhaustive, and vendor backports mean upstream version numbers cannot reliably determine every downstream kernel's status.
- The discoverer identified a potential container-escape route for workloads with suitable CAP_NET_ADMIN access but stated that this route had not been validated.
- Exploit reliability outside the published x86-64 kernel-build records and stated host prerequisites is not established.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No confirmed in-the-wild exploitation found; working public exploit code is available, but CISA had not listed the vulnerability in its Known Exploited Vulnerabilities catalogue as of 5 August 2026.
The investigation began by separating the 5 August news report from the underlying vulnerability disclosure and checking its links against primary records. The discoverer's write-up, oss-security disclosure, kernel commit, CVE record and NVD entry consistently identify CVE-2026-64531 and the same 16-bit nested-attribute truncation flaw. A public exploit is verified, while the checked CISA catalogue contained no matching entry and no source established in-the-wild exploitation; the resulting assessment is therefore a high-impact local privilege-escalation vulnerability with elevated exposure risk, not a confirmed active campaign.
- What event and claims did the supplied story describe?Read the 5 August report and followed its references to the technical write-up, kernel fix, exploit repository and CloudLinux advisory.thehackernews.com ↗
The report attributed CVE-2026-64531 to the Linux kernel Open vSwitch datapath and claimed broad local-root exposure, a public exploit and upstream fixes.
why This framed the claims requiring primary-source verification without treating the article itself as proof.
- Did the discoverer document the vulnerability, timeline, prerequisites and affected releases?Read Manizada's disclosure and technical assessment.heyitsas.im ↗
The write-up dated disclosure to 28 July, described the nested Netlink length truncation, documented local and namespace prerequisites, listed tested distributions and named the first fixed upstream releases.
why This established the original researcher's account and narrowed the affected scope to systems meeting specific kernel, module and namespace conditions.
- Does the upstream correction support the stated mechanism?Inspected the Linux kernel fix and its commit message.github.com ↗
The commit states that oversized nested Open vSwitch actions could receive a truncated nla_len and later be walked as a structurally different stream; it adds rejection and cleanup handling.
why The upstream code record independently confirms the core mechanism and the intended correction.
- Is usable public exploit code actually available?Opened the discoverer's public repository and reviewed its contents and warnings.github.com ↗
The repository contains an OVSwrap exploit, kernel-build data and mitigation material, with warnings that execution is destructive and prerequisite-dependent.
why This confirms public exploit availability but does not demonstrate malicious or in-the-wild use.
- What operational exposure and mitigation information is available from an affected vendor?Reviewed CloudLinux's advisory, affected streams, livepatch status and incident checks.blog.cloudlinux.com ↗
CloudLinux identifies affected CloudLinux 9, 10 and Ubuntu-based streams, confirms a working public exploit, recommends blocking openvswitch.ko when unused and advises checking sudoers, accounts and SSH keys after suspected compromise.
why This supplies independent vendor corroboration and concrete defensive actions while showing that downstream kernel status differs from upstream numbering.
- Is the CVE and severity independently recorded by a government vulnerability database?Read the National Vulnerability Database entry.nvd.nist.gov ↗
NVD records the kernel.org description and a kernel.org CVSS 3.1 score of 7.8 with local attack vector, low privileges and high confidentiality, integrity and availability impact.
why This verifies the CVE relationship and severity without using probability scores as evidence of exploitation.
- Does the original coordinated public disclosure corroborate dates, scope and fixed versions?Read the 28 July oss-security posting.openwall.com ↗
The disclosure records the 19 June private report, 24 July stable fixes, required Open vSwitch and conntrack capabilities, tested distributions, fixed releases and mitigations.
why This primary disclosure corroborates the timeline and clarifies that the tested distribution list is conditional and non-exhaustive.
- Does the authoritative CVE record map the flaw to Linux kernel Open vSwitch?Opened the CVE Program record maintained by kernel.org as the CVE Numbering Authority.cve.org ↗
The record identifies the Open vSwitch nested-action flaw, CVSS 7.8 and multiple stable-tree fix references.
why This confirms that CVE-2026-64531, rather than another vulnerability, is the operational identifier for this story.
- Is active exploitation confirmed by CISA's authoritative catalogue?Checked the current CISA Known Exploited Vulnerabilities data for the CVE identifier.cisa.gov ↗
The catalogue version dated 5 August 2026 contained no CVE-2026-64531 entry.
why Absence is not proof that exploitation has never occurred, but combined with the lack of incident reporting it prevents classification as confirmed active exploitation.
Research coverage
All 68 registered source leaves were evaluated for this run: 59 completed, 0 were unavailable, 2 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (2 primary, 2 corroborating, 1 contextual and 0 PoC/exploit references). 54 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| NVDcve | ok900 records | Primary evidence1 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok14 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| CISA KEVkev | ok1661 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| FIRST EPSSepss | ok7492 records | Context1 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| BleepingComputernews | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | stale fallback0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok672 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1007 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok16 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok16 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Rapid7news | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 16 opened outside the registered collection
Vulnerability & exploitation1
Technical references3
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
PoC & exploit code1
Researcher-published exploit and mitigation repository; the exploit is destructive and has specific kernel and host prerequisites.
Vendor & gov advisories4
Kernel.org CVE record confirms the Open vSwitch flaw, affected status, upstream fixes and CVSS 3.1 score of 7.8.
Government vulnerability record independently reproduces the kernel.org description and local privilege-escalation vector.
Upstream commit rejects generated nested attributes that cannot fit in the 16-bit Netlink length field.
Provides affected CloudLinux kernel streams, livepatch status, module-blocking guidance and post-compromise checks.
Analysis & research3
Discoverer's technical analysis, tested-distribution matrix, prerequisites, fixed releases and mitigations.
Original public disclosure records the June report, 24 July stable fixes, 28 July disclosure and tested scope.
Secondary reporting that led to the primary disclosure, fix and exploit records.