New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch

Summary: A memory corruption flaw in the Linux kernel's Open vSwitch datapath, tracked as CVE-2026-64531 with a CVSS score of 7.8 and codenamed OVSwrap, lets an ordinary local user reach root on default-configured systems without an existing OVS bridge, a running ovs-vswitchd, or host-level CAP_NET_ADMIN. Researcher Asim Manizada disclosed it on July 28, 2026, with a public proof-of-concept carrying records for roughly 800 x86-64 kernel builds, and the upstream fix shipped in stable trees on July 24 in releases including Linux 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5.
What's compelling: The unsafe assignment sat in the kernel for 13 years and only became reachable after a March 2025 change removed a 32 KiB cap on the generated action stream, so the flaw now ships in default configurations across tested distributions from AlmaLinux and Debian to Ubuntu, Fedora, and Arch. Where multiple users or untrusted workloads share a host, CloudLinux's advisory notes the local user may be an attacker who already compromised one site through an unrelated flaw, and OVSwrap is what turns that single-account problem into a whole-server one.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-64531
Related: ⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026