# 13-Year-Old Linux Kernel Flaw Allows Local Users to Gain Root Access OVSwrap vulnerability creates critical security weaknesses in many Linux distributions. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-08-05 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/e017d0b7-900e-4b87-870d-dd1e2845bcce ## Discovery and Significance Security researcher Asim Manizada discovered a 13-year-old Linux kernel flaw named OVSwrap. Registered as CVE-2026-64531 with a CVSS score of 7.8, this vulnerability allows local users to gain root privileges through Open vSwitch datapath. The patch was released to stable trees on July 24, but proof-of-concept exploits targeting over 800 kernel builds are already publicly available. This medium-high risk vulnerability affects numerous default-configured Linux distributions. ## Technical Details The flaw stems from a validation oversight in how Open vSwitch processes action lists from userspace. While the total internal action stream can exceed 64 KiB, there's no check for individual nested action attributes fitting within the 16-bit length field. This allows attackers to submit valid actions containing hundreds of small conntrack actions. The unsafe assignment existed in code for 13 years but remained unexploitable due to a 32 KiB cap on generated action streams until March 2025. ## Critical Change A March 2025 modification removed the 32 KiB limit that was causing unpredictable failures in large OpenStack deployments. The review process for this change didn't address security implications. Without this limit, when generated actions exceed 65,535 bytes, a 16-bit nla_len overflow occurs. This overflow creates a trusted length value that causes parsing to resume from the middle of attacker-controlled conntrack data, bypassing normal security checks. ## Exploit Mechanism The exploit chains three primitives: kernel pointer leak via fake OUTPUT action, arbitrary kernel read through forged tunnel SET action, and targeted decrement via teardown of forged tunnel destination pointer. The PoC uses leaked kernel information to locate critical memory structures, bypass protections, and ultimately change attacker's UID/GID to zero. It deliberately leaves processes and OVS state to avoid unsafe teardown while achieving root access. ## Affected Systems Default configurations of AlmaLinux 9-10, Alpine 3.22-3.24, Amazon Linux 2023, Arch, CentOS Stream 9-10, Debian 12-13, Fedora 42-44, Kali 2026.1, Linux Mint 22.3, NixOS, openSUSE Tumbleweed, Pop!_OS, Rocky Linux 9-10, and Ubuntu 22.04 are exploitable. Ubuntu 24.04 blocks direct namespace creation via AppArmor but falls to aa-exec fallback. Ubuntu 26.04 requires disabling AppArmor's user-namespace restriction for exploitation. ## Attack Prerequisites Attackers need minimal prerequisites to reach vulnerable code: no existing OVS bridge, running ovs-vswitchd, or host-level CAP_NET_ADMIN required. Only CAP_NET_ADMIN in the user namespace owning the network namespace is needed. Ordinary users can create new network namespaces via unprivileged user namespaces using simple unshare -Urn commands, making many default configurations vulnerable. ## Interim Mitigations Installing vendor-patched kernels is the optimal solution. When immediate patching isn't possible and OVS isn't required, blocking future module loads via 'echo install openvswitch /bin/false /etc/modprobe.d/ovswrap.conf' provides temporary protection (though reboot is needed for loaded modules). Disabling unprivileged user namespaces closes the local user vector but doesn't protect against container processes with existing CAP_NET_ADMIN over controlled namespaces. ## Impact and Implications OVSwrap offers memory corruption with logic-bug-grade reliability - an uncommon challenge for defenders. The vulnerability affects default configurations across major Linux distributions. The PoC repository includes an emergency BPF guard for environments requiring both OVS and namespaces. Security teams should prioritize this vulnerability due to its reliable exploitability and potential for privilege escalation in common configurations. ## Sources covering this story - https://securityaffairs.com/196657/hacking/ovswrap-13-year-old-linux-kernel-flaw-lets-local-users-become-root.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._