Ethical Hacking News
A new critical vulnerability has been discovered in the Linux kernel's Open vSwitch datapath, exposing ordinary users to unprecedented root privilege. System administrators are advised to take immediate action to patch their systems and block future module loads to mitigate this high-severity bug.
The Linux kernel has a critical vulnerability (CVE-2026-64531) that exposes ordinary users to high-severity root privilege. The bug, called OVSwrap, allows an attacker to gain root privilege via Open vSwitch, putting multiple Linux distributions at risk. The vulnerability arises from a memory corruption bug in the kernel datapath and can be exploited by creating private user and network namespaces. Only OVS conntrack support, the FTP conntrack helper, and sudo need to be installed to exploit this vulnerability. System administrators are advised to install patched vendor kernels or block future module loads to mitigate the risk.
THN Exclusive: New Linux Kernel Flaw Exposes Ordinary Users to High-Severity Root Privilege, Alerting Security Researchers and System Administrators Worldwide to Take Immediate Action
The cybersecurity community is abuzz with the revelation of a new critical vulnerability in the Linux kernel's Open vSwitch datapath, which threatens the security of ordinary local users. The bug, tracked as CVE-2026-64531 and codenamed OVSwrap, was disclosed by security researcher Asim Manizada on July 28, 2026. This devastating flaw allows an attacker to gain root privilege via Open vSwitch, putting a wide range of Linux distributions at risk.
In a detailed technical write-up, Manizada explained the nature of the vulnerability, which arises from a memory corruption bug in the kernel datapath. The bug sits in a seemingly innocuous part of the codebase, but its effects are far-reaching and catastrophic. An ordinary user can create private user and network namespaces with unshare -Urn, gain CAP_NET_ADMIN inside that namespace, and reach the vulnerable flow-installation path. If the openvswitch module is installed but not loaded, resolving its Generic Netlink family name can load it automatically, further exacerbating the issue.
Manizada emphasized the severity of the bug, describing it as a "logic-bug-grade reliability" vulnerability. He also highlighted the exploitability of the bug, which chains three primitives from the wraparound: a kernel pointer leak through a fake OUTPUT action, an arbitrary kernel read through a forged tunnel SET action, and a targeted decrement through teardown of a forged tun_dst pointer. These primitives are used to find a host process's credentials, on modern kernels, decrement fsuid and fsgid to zero.
In order to exploit this vulnerability, attackers require only OVS conntrack support, the FTP conntrack helper, and sudo to be installed. The released proof-of-concept is explicitly destructive, corrupting a live kernel credential, modifying /etc/sudoers.d or /etc/sudoers, opening a root shell, and leaving processes and OVS state behind to avoid unsafe teardown.
Manizada reported the issue to security@kernel.org and the OVS maintainers on June 19. The first fixed upstream releases are Linux 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. However, distribution kernels carry backports and downstream changes, so the vendor tracker is the safer source of truth.
To mitigate this vulnerability, system administrators are advised to install a patched vendor kernel where one is available. Where Open vSwitch is not required, the fastest interim step is to block future module loads by creating an override in /etc/modprobe.d/ovswrap.conf, which overrides blocks future module-load attempts; a module already resident in memory must still be removed or cleared by rebooting.
Disabling unprivileged user namespaces closes the ordinary local-user route but does not block a container or other process that already has CAP_NET_ADMIN over an attacker-controlled network namespace. Manizada described this direction as theoretically reachable but did not demonstrate it in the released PoC. The PoC repository also includes an emergency BPF guard for environments that must keep both OVS and namespaces active.
The risk is especially acute where multiple users or untrusted workloads share a host, potentially turning a single-account problem into a whole-server one. In such scenarios, the local user in question may be an attacker who already compromised one site through an unrelated flaw, and OVSwrap is what turns that single-account problem into a whole-server one.
Related Information:
https://www.ethicalhackingnews.com/articles/New-OVSwrap-Linux-Kernel-Flaw-Exposes-Local-Users-to-Unprecedented-Root-Privilege-ehn.shtml
https://thehackernews.com/2026/08/new-ovswrap-linux-kernel-flaw-lets.html
Published: Wed Aug 5 07:30:34 2026 by llama3.2 3B Q4_K_M
