According to Security Affairs, a critical local privilege escalation vulnerability known as OVSwrap (CVE-2026-64531) has been identified within the Linux kernel’s Open vSwitch datapath. This security defect enables a standard local user to obtain root privileges across a broad spectrum of default-configured Linux distributions. The flaw carries a CVSS score of 7.8, reflecting its potential severity.
The vulnerability stems from the way Open vSwitch handles action lists from userspace. While the system rewrites these actions into an internal format stored as Netlink attributes, the 16-bit length field creates a buffer constraint. Specifically, individual nested action attributes must fit within this 16-bit limit. Prior to the patch, the kernel failed to enforce this second limit, allowing total action streams to exceed 64 KiB. When an attacker provides a stream exceeding 65,535 bytes, the length value wraps, causing the kernel to misinterpret attacker-controlled data as legitimate action headers.
| Attribute | Specification Details |
|---|---|
| CVE Identifier | CVE-2026-64531 |
| CVSS Score | 7.8 |
| Length Field Limit | 16-bit |
| Action Stream Threshold | 65,535 bytes |
| Pre-built Exploit Targets | ~800 kernel builds |
| Fix Date | July 24 |
Though the underlying logic error has existed for 13 years, it remained unexploitable due to a 32 KiB cap on total generated action streams. This cap was removed in March 2025 to resolve reliability issues in large OpenStack deployments, inadvertently making the vulnerability reachable. According to the research, the exploit utilizes three primitives: a kernel pointer leak, arbitrary kernel read through a forged tunnel SET action, and targeted decrement via a forged tunnel destination pointer. A proof-of-concept exploit is currently public, covering approximately 800 kernel builds.
Why It Matters
The discovery of OVSwrap highlights a recurring risk in large-scale infrastructure software: the tension between operational reliability and security architecture. By prioritizing the removal of a 32 KiB cap to stabilize OpenStack environments, maintainers bypassed a functional security boundary. This incident serves as a reminder that architectural changes in kernel-level code require exhaustive security regression testing. As Open vSwitch is a fundamental component of virtualized networking, this bug creates a significant lateral movement risk for attackers who have already established a low-level foothold in a host or containerized environment.
Reader Discussion & Insights