OVSwrap kernel flaw gives local users root on most Linux distributions

A researcher disclosed OVSwrap, a Linux kernel flaw in the Open vSwitch datapath that lets an ordinary local user gain root, and published a working exploit covering roughly 800 builds. Tracked as CVE-2026-64531, it is an integer wraparound in how Open vSwitch handles internally generated network action streams, giving a deterministic memory-corruption path. The attacker needs no existing switch, no running daemon, and no special privileges: where unprivileged user namespaces are enabled, they create a private namespace, gain network capabilities inside it, and reach the vulnerable code. The module can even auto-load on demand, so an empty module list does not mean safety. Default configurations of most major distributions tested as exploitable.

Check

Install the patched vendor kernel, which upstream fixed on July 24, and where you cannot patch immediately, disable unprivileged user namespaces to cut off the main path to the flaw.

Affected

Most default-configured Linux systems with the Open vSwitch module available and unprivileged user namespaces enabled (CVE-2026-64531); an ordinary local user can corrupt kernel memory and gain root, with a public exploit available.

Fix

Apply patched kernels and reboot, restrict unprivileged user namespaces where feasible, and prioritize shared and multi-tenant hosts, since any local foothold from another flaw or stolen access can escalate to full control.