# OVSWrap (CVE-2026-64531): Linux kernel Open vSwitch datapath 16-bit nla_len wraparound local privilege escalation with public PoC targeting ~800 x86-64 kernel builds

> CVE-2026-64531 (OVSWrap) is a memory-corruption local privilege escalation in the Linux kernel's Open vSwitch (OVS) datapath allowing an unprivileged local user to gain root code execution with logic-bug-grade reliability and no heap grooming required. The vulnerability is a 16-bit nla_len integer wraparound in OVS nested Netlink action attribute handling, latent for 13 years and exposed by a March 2025 commit that removed a 32 KiB cap on the generated action stream. A public Python PoC (github.com/manizada/OVSWrap) targets approximately 800 exact x86-64 kernel builds across 15+ major Linux distributions, achieving root via three primitives: kernel pointer leak, arbitrary kernel read, and targeted credential decrement. Upstream fix committed July 24, 2026; first fixed kernels 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5.

- **Published:** 2026-08-05T00:00:00Z
- **Last reviewed:** 2026-08-05T14:54:11.358Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1887
- **ID:** TL-2026-1887
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-64531

## Description

CVE-2026-64531 (OVSWrap) is a local privilege escalation vulnerability in the Linux kernel's Open vSwitch (OVS) datapath, discovered and reported by security researcher Asim Manizada. The vulnerability resides in the Netlink action attribute handling within net/openvswitch/flow_netlink.c, where OVS stores internally-generated flow actions as Netlink attributes using the standard nlattr structure. The nla_len field is 16 bits wide, limiting any single nested attribute to 65,535 bytes.

The bug — an unsafe assignment of a 16-bit length without bounds checking — existed for approximately 13 years but was neutralized by a separate 32 KiB cap on the total generated action stream. A commit in March 2025 (a1e64addf3ff, 'net: openvswitch: remove misbehaving actions length check') removed that cap without adding corresponding protection for individual nested attributes, exposing the latent wraparound. The review thread for this change did not address the security consequence of removing the guard.

To trigger the bug, an attacker submits a CLONE action containing hundreds of small conntrack (CT) sub-actions. On x86-64, each conntrack action expands to approximately 164 bytes during internal conversion (struct ovs_conntrack_info containing zone, helper, labels, timeout, template, and NAT state). When the generated nested CLONE action exceeds 65,535 bytes, the 16-bit nla_len field wraps to a small value (e.g., 65,612 mod 65,536 = 76). The kernel's validation passes because it validates the original (small) attribute list before expansion, and the nla_len assignment happens during generation, not as a validation gate.

Later consumers — specifically the flow dump and teardown code paths — trust the wrapped nla_len to determine where the current action ends and the next begins. The parser advances only the wrapped amount (e.g., 76 bytes from the CLONE header), landing at offset +0x004c, which is still inside the first generated conntrack object. Since conntrack labels and timeout names are attacker-controlled bytes, the attacker has already planted forged OVS action headers (OUTPUT, tunnel SET) at exactly this landing position. These are reinterpreted by the kernel as real actions, creating a fundamental mismatch: the kernel parsed one thing and executes a different action stream.

From this mismatch, the PoC constructs three primitives:
1. Kernel pointer leak — A fake OUTPUT action with nla_len=512 causes OVS to dump a 512-byte span from the flow. This span includes kernel pointers from subsequent generated conntrack objects (which contain real pointers to the FTP conntrack helper). By following the helper pointer → owning module → module kobject type pointer, the attacker deduces the randomized kernel base address.
2. Arbitrary kernel read — A fake tunnel SET action with an attacker-chosen tun_dst pointer is placed at the landing point. When OVS dumps the flow, it treats tun_dst as a pointer to real tunnel metadata and serializes fields (TOS, TTL, port, IPv4) from it back to userspace. Each byte read requires one fresh fake SET action using a tun_dst = target_address - field_offset construction.
3. Targeted 32-bit decrement (write primitive) — When OVS frees the forged action, it calls dst_release() on the tun_dst pointer, which decrements the destination's reference-count field at a fixed offset. One flow deletion performs one decrement. By repeatedly creating and deleting flows, the attacker drives fsuid/fsgid from their current value to zero in the target host process's credential structure.

With fsuid and fsgid reduced to zero in a host-side writer process, that process gains effective root access. It writes a passwordless sudo rule (e.g., the user can sudo without a password) to /etc/sudoers.d/ or appends to /etc/sudoers, then launches sudo -n bash to spawn a root shell.

Critically, the exploit requires no heap grooming — all values (kernel symbol offsets, struct sizes, field offsets) are static per kernel build and derivable from System.map, /proc/kallsyms, BTF, or debug packages. The PoC ships pre-derived records for approximately 800 exact x86-64 kernel builds. For non-covered builds, the PoC attempts dynamic derivation from available symbols or BTF.

The exploit is destructive by design: it corrupts a live kernel credential, permanently modifies sudoers configuration, and leaves detached processes and corrupted OVS state to avoid unsafe teardown. A reboot stops residual processes but does not undo the sudoers modification.

The overwrite path does not require an existing OVS bridge, running ovs-vswitchd, or host-level CAP_NET_ADMIN. Unprivileged user namespaces (unshare -Urn) supply CAP_NET_ADMIN inside a private namespace. If the openvswitch kernel module is not loaded, resolving its Generic Netlink family name triggers auto-loading via request_module() — an empty lsmod output does not guarantee safety.

AppArmor and SELinux do not block the exploit once the attacker obtains CAP_NET_ADMIN in their namespace. Ubuntu 24.04's AppArmor user-namespace restriction (apparmor_restrict_unprivileged_userns) blocks the initial unshare -Urn, but the PoC includes an aa-exec -p trinity fallback. Ubuntu 26.04 blocks this route entirely unless the restriction is disabled.

The upstream fix (commit 3f1f75536668, 'net: openvswitch: reject oversized nested action attrs') adds a bounds check in add_nested_action_end() that rejects generated nested attributes exceeding U16_MAX by returning -EMSGSIZE. The fix also implements proper cleanup of partially-constructed resource-owning action-list tails (tunnel destinations, conntrack actions) in reverse construction order before discarding the failed wrapper. First fixed in Linux 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. The 6.13, 6.14, 6.15, 6.16, 6.17, 6.19, and 7.0 series are EOL and receive no fix.

CloudLinux published KernelCare livepatches on August 4, 2026, for all affected CloudLinux platforms. Red Hat has Bugzilla #2507402 open with status 'Under Investigation.' Debian DSA-6405-1 covers Trixie. Ubuntu advisory infrastructure experienced availability issues (504 Gateway Timeouts on security pages as of July 31, 2026). As of August 5, 2026, CVE-2026-64531 is NOT listed in CISA KEV.

Immediate mitigations for systems not running OVS: block the openvswitch module with 'install openvswitch /bin/false' in /etc/modprobe.d/ (not blacklist, which only prevents autoloading through udev/hotplug — the install directive blocks the kernel-side request_module() call). If the module is already loaded and not in use: modprobe -r openvswitch. If OVS and unprivileged namespaces must remain available, the PoC repository includes an emergency BPF guard. Disabling unprivileged user namespaces (kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0) also blocks the ordinary local-user route but does not block potential container escape by a process that already has CAP_NET_ADMIN over an attacker-controlled namespace.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1082 System Information Discovery
- T1007 System Service Discovery
- T1033 System Owner/User Discovery
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1098 Account Manipulation
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1222 File and Directory Permissions Modification
- T1480 Execution Guardrails
- T1027 Obfuscated Files or Information
- T1204 User Execution
- T1083 File and Directory Discovery

## Sources

- [The Hacker News: New OVSWrap Linux Kernel Flaw Lets Attackers Gain Root on Major Linux Distributions](https://thehackernews.com/2026/08/new-ovswrap-linux-kernel-flaw-lets.html)
- [OVSWrap PoC Repository (GitHub)](https://github.com/manizada/OVSWrap)
- [Full Technical Writeup (heyitsas.im)](https://heyitsas.im/posts/ovswrap/)
- [NVD Entry for CVE-2026-64531](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-64531)
- [oss-security Disclosure (Asim Manizada)](http://www.openwall.com/lists/oss-security/2026/07/28/8)
- [oss-security Follow-up (Kevin Riggle)](http://www.openwall.com/lists/oss-security/2026/07/31/17)
- [oss-security Response (Thomas Ward)](http://www.openwall.com/lists/oss-security/2026/08/01/1)
- [Upstream Fix Commit (Linus Torvalds)](https://github.com/torvalds/linux/commit/3f1f755366687d051174739fb99f7d560202f60b)
- [Enabling Commit (March 2025)](https://github.com/torvalds/linux/commit/a1e64addf3ff9257b45b78bc7d743781c3f41340)
- [CVE Announcement (Greg Kroah-Hartman via oss-security)](https://lists.openwall.net/linux-cve-announce/2026/07/27/5)
- [CloudLinux OVSWrap Advisory and Mitigation Guide](https://blog.cloudlinux.com/ovswrap-cve-2026-64531-mitigation/)
- [Red Hat Bugzilla #2507402](https://bugzilla.redhat.com/show_bug.cgi?id=2507402)
- [Debian DSA-6405-1 (Trixie)](https://www.debian.org/security/2026/dsa-6405)
- [CISA Known Exploited Vulnerabilities Catalog (kev.json — checked: CVE-2026-64531 NOT found)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [CloudLinux Status Page (Incident byy8q48qhx01)](https://cloudlinux.statuspage.io/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1887