Threat reportVulnerabilityTL-2026-1887
OVSWrap (CVE-2026-64531): Linux kernel Open vSwitch datapath 16-bit nla_len wraparound local privilege escalation with public PoC targeting ~800 x86-64 kernel builds
OVSWrap (CVE-2026-64531) (TL-2026-1887), also tracked as OVSWrap, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-08-05. It has no confirmed attribution, affects Linux Linux Kernel, references 1 CVE (CVE-2026-64531), maps to 16 MITRE ATT&CK techniques (T1007, T1027, T1033), and is covered by 9 detection rules and 23 indicators of compromise.
- CVSS
- 7.8/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 23Indicators of compromise
Key facts for TL-2026-1887
- Threat ID
- TL-2026-1887
- Also known as
- OVSWrap
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, technology, telecoms, cloud-service-providers, managed-hosting
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 23
- Updates
- 2026-08-05 · revalidated 1× · latest source
Malware and tooling in OVSWrap (CVE-2026-64531)
Malware and tooling: Python 3.7+
How OVSWrap (CVE-2026-64531) works
CVE-2026-64531 (OVSWrap) is a memory-corruption local privilege escalation in the Linux kernel's Open vSwitch (OVS) datapath allowing an unprivileged local user to gain root code execution with logic-bug-grade reliability and no heap grooming required. The vulnerability is a 16-bit nla_len integer wraparound in OVS nested Netlink action attribute handling, latent for 13 years and exposed by a March 2025 commit that removed a 32 KiB cap on the generated action stream. A public Python PoC (github.com/manizada/OVSWrap) targets approximately 800 exact x86-64 kernel builds across 15+ major Linux distributions, achieving root via three primitives: kernel pointer leak, arbitrary kernel read, and targeted credential decrement. Upstream fix committed July 24, 2026; first fixed kernels 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5.
CVE-2026-64531 (OVSWrap) is a local privilege escalation vulnerability in the Linux kernel's Open vSwitch (OVS) datapath, discovered and reported by security researcher Asim Manizada. The vulnerability resides in the Netlink action attribute handling within net/openvswitch/flow_netlink.c, where OVS stores internally-generated flow actions as Netlink attributes using the standard nlattr structure. The nla_len field is 16 bits wide, limiting any single nested attribute to 65,535 bytes.
The bug — an unsafe assignment of a 16-bit length without bounds checking — existed for approximately 13 years but was neutralized by a separate 32 KiB cap on the total generated action stream. A commit in March 2025 (a1e64addf3ff, 'net: openvswitch: remove misbehaving actions length check') removed that cap without adding corresponding protection for individual nested attributes, exposing the latent wraparound. The review thread for this change did not address the security consequence of removing the guard.
To trigger the bug, an attacker submits a CLONE action containing hundreds of small conntrack (CT) sub-actions. On x86-64, each conntrack action expands to approximately 164 bytes during internal conversion (struct ovs_conntrack_info containing zone, helper, labels, timeout, template, and NAT state). When the generated nested CLONE action exceeds 65,535 bytes, the 16-bit nla_len field wraps to a small value (e.g., 65,612 mod 65,536 = 76). The kernel's validation passes because it validates the original (small) attribute list before expansion, and the nla_len assignment happens during generation, not as a validation gate.
Later consumers — specifically the flow dump and teardown code paths — trust the wrapped nla_len to determine where the current action ends and the next begins. The parser advances only the wrapped amount (e.g., 76 bytes from the CLONE header), landing at offset +0x004c, which is still inside the first generated conntrack object. Since conntrack labels and timeout names are attacker-controlled bytes, the attacker has already planted forged OVS action headers (OUTPUT, tunnel SET) at exactly this landing position. These are reinterpreted by the kernel as real actions, creating a fundamental mismatch: the kernel parsed one thing and executes a different action stream.
From this mismatch, the PoC constructs three primitives: 1. Kernel pointer leak — A fake OUTPUT action with nla_len=512 causes OVS to dump a 512-byte span from the flow. This span includes kernel pointers from subsequent generated conntrack objects (which contain real pointers to the FTP conntrack helper). By following the helper pointer → owning module → module kobject type pointer, the attacker deduces the randomized kernel base address. 2. Arbitrary kernel read — A fake tunnel SET action with an attacker-chosen tun_dst pointer is placed at the landing point. When OVS dumps the flow, it treats tun_dst as a pointer to real tunnel metadata and serializes fields (TOS, TTL, port, IPv4) from it back to userspace. Each byte read requires one fresh fake SET action using a tun_dst = target_address - field_offset construction. 3. Targeted 32-bit decrement (write primitive) — When OVS frees the forged action, it calls dst_release() on the tun_dst pointer, which decrements the destination's reference-count field at a fixed offset. One flow deletion performs one decrement. By repeatedly creating and deleting flows, the attacker drives fsuid/fsgid from their current value to zero in the target host process's credential structure.
With fsuid and fsgid reduced to zero in a host-side writer process, that process gains effective root access. It writes a passwordless sudo rule (e.g., the user can sudo without a password) to /etc/sudoers.d/ or appends to /etc/sudoers, then launches sudo -n bash to spawn a root shell.
Critically, the exploit requires no heap grooming — all values (kernel symbol offsets, struct sizes, field offsets) are static per kernel build and derivable from System.map, /proc/kallsyms, BTF, or debug packages. The PoC ships pre-derived records for approximately 800 exact x86-64 kernel builds. For non-covered builds, the PoC attempts dynamic derivation from available symbols or BTF.
The exploit is destructive by design: it corrupts a live kernel credential, permanently modifies sudoers configuration, and leaves detached processes and corrupted OVS state to avoid unsafe teardown. A reboot stops residual processes but does not undo the sudoers modification.
The overwrite path does not require an existing OVS bridge, running ovs-vswitchd, or host-level CAP_NET_ADMIN. Unprivileged user namespaces (unshare -Urn) supply CAP_NET_ADMIN inside a private namespace. If the openvswitch kernel module is not loaded, resolving its Generic Netlink family name triggers auto-loading via request_module() — an empty lsmod output does not guarantee safety.
AppArmor and SELinux do not block the exploit once the attacker obtains CAP_NET_ADMIN in their namespace. Ubuntu 24.04's AppArmor user-namespace restriction (apparmor_restrict_unprivileged_userns) blocks the initial unshare -Urn, but the PoC includes an aa-exec -p trinity fallback. Ubuntu 26.04 blocks this route entirely unless the restriction is disabled.
The upstream fix (commit 3f1f75536668, 'net: openvswitch: reject oversized nested action attrs') adds a bounds check in add_nested_action_end() that rejects generated nested attributes exceeding U16_MAX by returning -EMSGSIZE. The fix also implements proper cleanup of partially-constructed resource-owning action-list tails (tunnel destinations, conntrack actions) in reverse construction order before discarding the failed wrapper. First fixed in Linux 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. The 6.13, 6.14, 6.15, 6.16, 6.17, 6.19, and 7.0 series are EOL and receive no fix.
CloudLinux published KernelCare livepatches on August 4, 2026, for all affected CloudLinux platforms. Red Hat has Bugzilla #2507402 open with status 'Under Investigation.' Debian DSA-6405-1 covers Trixie. Ubuntu advisory infrastructure experienced availability issues (504 Gateway Timeouts on security pages as of July 31, 2026). As of August 5, 2026, CVE-2026-64531 is NOT listed in CISA KEV.
Immediate mitigations for systems not running OVS: block the openvswitch module with 'install openvswitch /bin/false' in /etc/modprobe.d/ (not blacklist, which only prevents autoloading through udev/hotplug — the install directive blocks the kernel-side request_module() call). If the module is already loaded and not in use: modprobe -r openvswitch. If OVS and unprivileged namespaces must remain available, the PoC repository includes an emergency BPF guard. Disabling unprivileged user namespaces (kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0) also blocks the ordinary local-user route but does not block potential container escape by a process that already has CAP_NET_ADMIN over an attacker-controlled namespace.
MITRE ATT&CK techniques used in TL-2026-1887
discovery
T1007 System Service Discovery; T1033 System Owner/User Discovery; T1082 System Information Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1480 Execution Guardrails
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Initial Access
Discovery
T1083 File and Directory Discovery
Persistence
defense-impairment
T1222 File and Directory Permissions Modification; T1685 Disable or Modify Tools
privilege-escalation
T1548 Abuse Elevation Control Mechanism
Reconnaissance
Affected products and versions in OVSWrap (CVE-2026-64531)
- Linux — Linux Kernel
Vulnerable versions: 5.15.180 through 5.15.211; 6.1.132 through 6.1.177; 6.6.84 through 6.6.144; 6.12.20 through 6.12.96; 6.13.8 through 6.17.x (EOL series); 6.18.0 through 6.18.39; 6.19 (all — EOL series); 7.0 (all — EOL series); 7.1.0 through 7.1.4
Fixed in: 5.15.212; 6.1.178; 6.6.145; 6.12.97; 6.18.40; 7.1.5; 7.2-rc4 - AlmaLinux — AlmaLinux 9 (el9_7+), 10 (el10_1+)
Vulnerable versions: 9.7; 9.8; 10.1; 10.2
Fixed in: Pending (tracked via AlmaLinux kernel stream) - Alpine Linux — Alpine Linux
Vulnerable versions: 3.22; 3.23; 3.24
Fixed in: Pending - Amazon Web Services — Amazon Linux 2023
Vulnerable versions: 2023 (KVM kernel tracks)
Fixed in: Pending - Arch Linux — Arch Linux
Vulnerable versions: linux (mainline); linux-lts; linux-zen
Fixed in: Pending - CentOS — CentOS Stream 9, 10
Vulnerable versions: Stream 9; Stream 10
Fixed in: Pending - Debian — Debian GNU/Linux
Vulnerable versions: 12 (Bookworm, 6.1.176-1); 13 (Trixie, unfixed)
Fixed in: 13 (Trixie): 6.12.100-1 (DSA-6405-1) - Fedora — Fedora Linux
Vulnerable versions: 40; 41; 42; 43; 44
Fixed in: Pending - Gentoo — Gentoo Linux
Vulnerable versions: amd64 (all branches)
Fixed in: Pending - Kali Linux — Kali Linux
Vulnerable versions: 2026.1
Fixed in: Pending
Remediation for OVSWrap (CVE-2026-64531)
Patches
- Linux 5.15.212 (stable tree)
- Linux 6.1.178 (stable tree)
- Linux 6.6.145 (stable tree)
- Linux 6.12.97 (stable tree)
- Linux 6.18.40 (stable tree)
- Linux 7.1.5 (stable tree)
- CloudLinux KernelCare livepatch (main feed, all affected CloudLinux platforms — August 4, 2026)
- Debian Trixie: 6.12.100-1 (DSA-6405-1)
Immediate actions
- Block openvswitch module loading: echo 'install openvswitch /bin/false' > /etc/modprobe.d/ovswrap.conf
- If openvswitch loaded and unused: modprobe -r openvswitch
- Apply emergency BPF guard included in the PoC repository for systems requiring both OVS and user namespaces
- Disable unprivileged user namespaces: sysctl -w kernel.unprivileged_userns_clone=0 (or user.max_user_namespaces=0 on CloudLinux 9/10)
- Audit /etc/sudoers and /etc/sudoers.d/ for unauthorized entries (post-exploitation indicator)
Workarounds
- Block openvswitch module via install directive (not blacklist — install blocks request_module() calls)
- Disable unprivileged user namespaces (caution: breaks rootless Podman/Docker, Snap/Flatpak, Chromium/Firefox sandboxes)
- Apply upstream BPF guard from PoC repository for environments that cannot disable namespaces or OVS
Longer-term hardening
- Patch vendor kernel to fixed version per distribution tracker
- Apply KernelCare livepatch where available (cloudlinux.com — updated August 4, 2026)
- Adopt kernel update cadence aligned with stable tree LTS releases
- Evaluate Open vSwitch usage: if OVS not required, keep module permanently blocked
- Implement kernel module integrity monitoring (audit module load events)
CVEs associated with OVSWrap (CVE-2026-64531)
Weaknesses (CWE) in OVSWrap (CVE-2026-64531)
Timeline of OVSWrap (CVE-2026-64531)
- Unsafe 16-bit nla_len assignment added to net/openvswitch/flow_netlink.c approximately 13 years ago. No bounds check ensured the generated nested action length fit within U16_MAX. Neutralized by separate 32 KiB cap on total generated action stream.
- Commit a1e64addf3ff ('net: openvswitch: remove misbehaving actions length check') removes the 32 KiB cap on the total generated sw_flow_actions stream. The review thread does not address the security consequence of removing the guard. This commit is backported into most upstream stable trees.
- Security researcher Asim Manizada began investigating the OVS datapath action-stream internals, using LLM-assisted 'hunter agent' methodology to reason about kernel memory layout ahead of the July 2026 disclosure.
- Security researcher Asim Manizada reports the vulnerability to security@kernel.org and the Open vSwitch maintainers. Embargo agreed with linux-distros@.
- Upstream fix commit 3f1f75536668 ('net: openvswitch: reject oversized nested action attrs') lands in the Linux kernel stable trees. First fixed stable releases: 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5.
- CVE-2026-64531 is published by NVD with CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). CVE announcement via Greg Kroah-Hartman on linux-cve-announce.
- Debian publishes DSA-6405-1 covering Trixie (testing) with fixed kernel 6.12.100-1. Bookworm (stable) confirmed vulnerable, fix pending. Bullseye (oldstable) not affected.
- Red Hat opens Bugzilla #2507402 to track CVE-2026-64531. Status: Under Investigation. RHEL 9 and 10 confirmed affected; RHEL 8 confirmed not affected.
- Public disclosure: oss-security posting by Asim Manizada with full technical details, exploit mechanism, and affected distro matrix. Public PoC published to github.com/manizada/OVSWrap. Full technical writeup published at heyitsas.im/posts/ovswrap/.
- Tenable released Nessus plugin 330131 for scanning/detecting CVE-2026-64531 exposure.
- Kevin Riggle reports that ubuntu.com/security/CVE-2026-64531 returns 504 Gateway Timeout. Ubuntu security portal appears overloaded; Ubuntu typically tracks CVEs promptly even without fixes.
- Thomas Ward (Canonical) responds that Ubuntu is aware of CVE-2026-64531 despite public tracker issues; confirms backend data infrastructure problems affecting CVE site.
- CloudLinux publishes KernelCare livepatches in the main feed for all affected CloudLinux platforms (CloudLinux 9, 10, and Ubuntu 22.04 LTS). Subscribed servers receive patches automatically; manual pull with kcarectl --update.
- CIQ publishes a mitigation and detection guide for Rocky Linux; Security Affairs publishes independent coverage of OVSWrap.
- The Hacker News publishes article on OVSWrap, raising public awareness. CVE-2026-64531 remains absent from CISA KEV catalog. Not subject to BOD 26-04 mandatory remediation timelines at this time.
Update history for TL-2026-1887
- 2026-08-05: What changed No escalation of severity/exploitability/status/attribution — the newer report's own record claims exploitability=ACTIVE, but neither its body nor its timeline shows confirmed in-the-wild exploitation (only PoC availability, a
Sources cited for OVSWrap (CVE-2026-64531)
- The Hacker News: New OVSWrap Linux Kernel Flaw Lets Attackers Gain Root on Major Linux Distributions
- OVSWrap PoC Repository (GitHub)
- Full Technical Writeup (heyitsas.im)
- NVD Entry for CVE-2026-64531
- oss-security Disclosure (Asim Manizada)
- oss-security Follow-up (Kevin Riggle)
- oss-security Response (Thomas Ward)
- Upstream Fix Commit (Linus Torvalds)
- Enabling Commit (March 2025)
- CVE Announcement (Greg Kroah-Hartman via oss-security)
- CloudLinux OVSWrap Advisory and Mitigation Guide
- Red Hat Bugzilla #2507402
- Debian DSA-6405-1 (Trixie)
- CISA Known Exploited Vulnerabilities Catalog (kev.json — checked: CVE-2026-64531 NOT found)
- CloudLinux Status Page (Incident byy8q48qhx01)
Detection coverage for TL-2026-1887
As of 2026-08-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1887 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.