Skip to main content

Security Bulletin

[Security Advisory] Linux Kernel Open vSwitch Local Privilege Escalation Vulnerability(CVE-2026-64531）

A local privilege escalation vulnerability (CVE-2026-64531, alias “OVSwrap”) has been disclosed in the Linux kernel Open vSwitch (OVS) module. A local, unprivileged attacker can exploit it to escalate to root and take full control of the host. Technical details, a PoC, and an EXP are already public; no in-the-wild exploitation has been observed to date. We recommend assessing your exposure and remediating as soon as possible.

1 Vulnerability Details

CVE ID

CVE-2026-64531

Alias

OVSwrap

Severity

High (CVSS 3.1: 7.8)

Affected Component

Open vSwitch kernel datapath module 

Disclosure Status

Technical details, PoC, and EXP are all public 

no known in-the-wild exploitation

Description

The OVS kernel module lacks a length boundary check when generating nested actions. An attacker can craft an oversized nested action, causing the Netlink nla_len (16-bit) field to truncate. This leads to parser desync and kernel memory corruption, ultimately allowing escalation from a regular user to root.

Exploitation Requirements

Local, unprivileged user access is sufficient; the kernel must have the OVS module loaded or loadable (CONFIG_OPENVSWITCH); the attacker needs CAP_NET_ADMIN within a network namespace (a container process with that capability could in theory also reach this path).

2 Affected / Fixed Versions

Kernel Branch

Affected Range

Fix Status

5.15

5.15.180 ~ .211

Fixed in 5.15.212+

6.1

6.1.132 ~ .177

Fixed in 6.1.178+

6.6

6.6.84 ~ .144

Fixed in 6.6.145+

6.12

6.12.20 ~ .96

Fixed in 6.12.97+

6.18

6.18.0 ~ .39

Fixed in 6.18.40+

7.1

7.1.0 ~ .4

Fixed in 7.1.5+

Mainline

7.2-rc1 ~ rc3

Fixed in 7.2-rc4+

6.13 / 6.14–17 / 6.19 / 7.0

All released versions

Branch is EOL, no fix available — upgrade to a supported branch

Known affected distributions include, but are not limited to: RHEL 9/10, Debian 12/13/14, AlmaLinux 9.7/9.8/10.1/10.2, as well as both Desktop and Server editions of Ubuntu 22.04/24.04.

3 Quick Self-Check

uname -r                      # check whether the kernel version falls in the affected range
lsmod | grep openvswitch      # no output = module not loaded, not currently affected

4 Remediation

4.1 Upgrade to a Fixed Version (Recommended)

Assess the business impact, then upgrade to the fixed version listed above. 

4.2 Temporary Mitigation (if unable to upgrade immediately)

Block the openvswitch module from loading to cut off the attack path (run as root):

sh -c "printf 'install openvswitch /bin/false\n' > /etc/modprobe.d/block-CVE-2026-64531.conf; rmmod openvswitch 2>/dev/null; true"

Verify: cat /proc/modules | grep openvswitch (no output means the mitigation is in effect).

Note: this will affect virtual/container networking that depends on the OVS kernel module — please assess before applying, and back up data before upgrading.

5 Timeline

2026-07-27

Vulnerability details, PoC, and EXP publicly disclosed

2026-07-30

Upstream kernel stable patch versions released (5.15.212 / 6.1.178 / 6.6.145 / 6.12.97, etc.)

2026-08-05

This advisory published

6 Support

If you have any questions, please contact our technical support team via the ticket system. We will continue to monitor this vulnerability and update this advisory as new information becomes available.