OVSwrap is a 13-year-old Linux kernel flaw that lets local users gain root privileges on most distributions using Open vSwitch.

Giving LLMs geometric visualization tools to discover CVE-2026-64531

CVE-2026-64531 lets local users exploit Open vSwitch kernel memory corruption to gain root, with a public PoC covering roughly 800 builds.

OVSwrap (CVE-2026-64531) nutzt eine Kernel-Lücke im Open-vSwitch-Datapath, um lokale Nutzer über Namespaces auf betroffenen Systemen zu Root zu machen. PoC mit ~800 Kernel-Builds.

Posted by Kevin Riggle on Jul 31 Does anybody have any color as to why Ubuntu hasn't picked this up yet? Usually they're good about picking up the CVE even if they don't have a fix in place yet. If as is claimed in the report both 22.04 and 24.04 are vulnerable in default configuration out of the box, I would expect the CVE to be listed on https://ubuntu.com/security/ but it doesn't show up in search results and https://ubuntu.com/security/CVE-2026-64531 ...

Posted by Thomas Ward on Jul 31 (Since my main mail and MS365 being the mail provider is, apparently, Not Okay here, I have to send from my alternate address... which ends up here anyways.) Kevin, The Ubuntu CVE website and tracker is a little fubar. This said, the CVE data is actually available in a separate git repository which has all the CVEs. The CVE is listed as an Active CVE and there are no releases yet with the fix. This does not mean that Ubuntu is ignoring...

CVE-2026-64531 lets local users exploit Open vSwitch kernel memory corruption to gain root, with a public PoC covering roughly 800 builds.

Posted by manizada on Jul 28 Hi folks, Emailing here now that the embargo agreed upon with linux-distros@ has expired. Flagging a local root vulnerability in the Linux kernel's Open vSwitch datapath (originally reported to security () kernel org and OVS maintainers on Jun 19). The fix is now public and has shipped in the relevant stable trees: 3f1f75536668 ("net: openvswitch: reject oversized nested action attrs") The first fixed upstream stable releases...

The article describes a layered Linux privilege escalation detection framework that combines general root-transition logic with technique-specific rules for SUID abuse, unshare, Python-driven exploits, and kernel page-cache corruption. It also reviews 2026 Linux LPE cases such as Copy Fail, DirtyFrag, Fragnesia, DirtyDecrypt, pedit COW, DirtyClone, CIFSwitch, OVSwrap, and CVE-2026-46333, showing how Elastic Defend and Auditd can catch them in practice. #CopyFail #DirtyFrag #Fragnesia #DirtyDecrypt #peditCOW #DirtyClone #CIFSwitch #OVSwrap #CVE-2026-46333

Posted by Kevin Riggle on Aug 21 Hey Thomas, Sorry for my delayed response. I see that these patches are now in the process of landing. Thank you so much for digging in on this and providing this context! Best, - Kevin

Giving LLMs geometric visualization tools to discover CVE-2026-64531

CVE-2026-64531 lets local users exploit Open vSwitch kernel memory corruption to gain root, with a public PoC covering roughly 800 builds.

Haz clic para acceder al contenido completo.

Linux kernel'de 18 yıldır saklanan iki kritik zafiyet açıklandı: CVE-2026-64564 ve CVE-2026-64531. SCTP ve Open vSwitch modülleri hiç kullanılmasa bile saldırı yüzeyi açık kalabiliyor. NixOS'ta declar...

Le bulletin du vendredi 7 août 2026.

A high-severity Linux kernel vulnerability, CVE-2026-64531 (OVSwrap), allows a local unprivileged user to escalate privileges to root, threatening cloud...

Uma falha de corrupção de memória no datapath do Open vSwitch do kernel Linux — batizada OVSwrap (CVE-2026-64531, CVSS 7.8) — permite que qualquer utilizador local sem privilégios obtenha root na maioria das distribuições, sem precisar de sudo, de um...

OVSwrap is a 13-year-old Linux kernel flaw that lets local users gain root privileges on most distributions using Open vSwitch. Security researcher Asim Manizada disclosed OVSwrap (CVE-2026-64531, CVSS score of 7.8), a local privilege escalation vulnerability in the Linux kernel’s Open vSwitch datapath that lets an ordinary user become root on a wide range of […]

Le composant noyau d'Open vSwitch, un logiciel réseau très répandu sur les serveurs Linux, contient la faille OVSwrap (CVE-2026-64531). Un compte utilisateur ordinaire, sans droit particulier, obtient...