Critical Linux OVSwrap CVE-2026-64531 Flaw Lets Local Attackers Gain Root Access

A newly disclosed Linux kernel vulnerability tracked as CVE-2026-64531, commonly referred to as OVSwrap, exposes affected systems to local privilege-escalation attacks through the Open vSwitch (OVS) kernel implementation.

The vulnerability results from improper handling of oversized nested Netlink attributes used for Open vSwitch flow actions.

An attacker with sufficient access to the vulnerable networking functionality could exploit the flaw to corrupt how the kernel interprets action data and potentially elevate privileges from an unprivileged account to root.

Critical Linux OVSwrap CVE-2026-64531 Flaw

The Linux kernel CVE record confirms that the issue affects net/openvswitch/flow_netlink.c and involves truncation of the 16-bit nla_len field. (NVD)

Security researcher Asim Viladi Oglu Manizada publicly disclosed technical information about OVSwrap in late July 2026. At the core of the vulnerability is the way Open vSwitch converts flow actions supplied through userspace into internal Netlink attributes.

Although the complete generated action stream can legitimately exceed 64 KiB, individual nested Netlink attributes are constrained because their nla_len field is represented using a 16-bit unsigned integer. This means a single nested attribute cannot safely represent a size exceeding U16_MAX, or 65,535 bytes. (NVD)

The vulnerability became reachable after Linux kernel commit a1e64addf3ff, which removed an earlier action-length restriction.

According to the official CVE description, this change allowed the overall sw_flow_actions stream to exceed 64 KiB but simultaneously removed a safeguard that prevented individual generated nested attributes from becoming larger than the 16-bit length field could represent. Consequently, an oversized container could be finalized with a truncated nla_len value. (NVD)

An attacker can exploit this condition by constructing an oversized nested Open vSwitch action, such as a CLONE action containing numerous conntrack-related actions.

Once its size passes the 65,535-byte boundary, the stored attribute length can wrap to a significantly smaller value. When Open vSwitch subsequently processes, dumps, or tears down the generated action stream, the kernel may interpret data inside the original nested structure as separate OVS actions.

The kernel therefore processes an action layout that differs from the structure originally validated. (NVD)The security impact is particularly serious because successful exploitation can turn the parsing inconsistency into kernel-memory manipulation capabilities.

Technical exploitation can leverage carefully positioned attacker-controlled data to influence subsequent action parsing, potentially exposing kernel information and enabling additional memory operations.

Such primitives can ultimately be chained to manipulate security-sensitive kernel structures, including process credentials, resulting in local privilege escalation to root.

The attack surface is also important for containerized and multi-user Linux environments. Systems exposing the vulnerable Open vSwitch functionality through network namespaces can face increased risk when users or containers obtain the capabilities necessary to interact with the affected networking subsystem.

Rocky Linux mitigation guidance notes that disabling unprivileged user namespaces can block one local-root attack path, although it does not necessarily address container scenarios where an attacker already possesses CAP_NET_ADMIN. (CIQ Knowledge Base)

The official CVE record identifies affected stable kernel ranges including Linux 5.15.180 before 5.15.212, 6.1.132 before 6.1.178, 6.6.84 before 6.6.145, and 6.12.20 before 6.12.97, alongside additional affected kernel branches.

The vulnerability has now been corrected by rejecting generated nested Open vSwitch action attributes that cannot safely fit within nla_len. (NVD)

Linux administrators should prioritize installing patched kernel packages supplied by their distributions and reboot systems into the updated kernel.

Organizations that do not use Open vSwitch can reduce exposure by preventing the openvswitch kernel module from loading. Where immediate patching is impossible, restricting unprivileged namespaces can provide additional protection against certain exploitation paths.

Administrators should carefully validate these mitigations because disabling Open vSwitch can disrupt OVN, SDN, virtualization, and other networking infrastructure dependent on the kernel datapath.