OSG-SEC-2026-07-29 OVSwrap kernel net openvswitch reject oversized nested action attrs (CVE-2026-64531)

Dear OSG Security Contacts,

CVE-2026-64531, also known as OVSwrap, is a local privilege escalation vulnerability in the Linux kernel's Open vSwitch (OVS) datapath. The flaw allows an unprivileged local user with control over a network namespace to exploit oversized nested action attributes, which can potentially be exploited to achieve arbitrary code execution with root privileges. A proof of concept (PoC) script has been released for this vulnerability.

WHAT ARE THE VULNERABILITIES:

A local privilege escalation vulnerability in the Linux kernel exists in Open vSwitch datapath caused by improper handling of oversized nested Netlink attributes. When generated flow actions exceed the 16-bit nla_len limit, nested actions such as CLONE or CT can be assigned truncated length values, causing the parser to misinterpret the action stream during later processing. According to publicly available research, this flaw can be leveraged to disclose kernel pointers, perform arbitrary kernel memory reads, and achieve local privilege escalation on vulnerable systems.

IMPACTED VERSIONS:

Red Hat Enterprise Linux

This CVE is under investigation by Red Hat Product Security. RHEL 9 and 10 are affected. RHEL 8 is not affected.

Debian

Security updates are available for bullseye and sid. See the Debian Security Tracker[3] for the latest status of other supported releases.

Ubuntu

Publicly available exploit code has been demonstrated on Ubuntu 24.10 (Oracular Oriole), successfully obtaining root privileges on a vulnerable system.

WHAT YOU SHOULD DO:

Apply patches as they become available.

Mitigations

Unload the openvswitch kernel module if it is not required: sudo modprobe -r openvswitch To prevent the module from being loaded again, create a blacklist configuration: sudo tee /etc/modprobe.d/blacklist-openvswitch.conf <<EOF blacklist openvswitch install openvswitch /bin/false EOF If the module is already loaded and cannot be unloaded because it is in use, a system reboot may be required after applying the blacklist for the mitigation to take effect. Restrict unprivileged user namespaces if applicable to your environment.

REFERENCES

[1] https://access.redhat.com/security/cve/cve-2026-64531
[2] https://lore.kernel.org/linux-cve-announce/2026072732-CVE-2026-64531-e4ce@gregkh/T/#u
[3] https://security-tracker.debian.org/tracker/CVE-2026-64531
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-64531

Please contact the OSG security team at [email protected] if you have any questions or concerns. OSG Security Team