Vulnerabilities · 54 days ago

Local Linux Users Can Reach Root Through OVS Datapath

Ordinary local users can now reach kernel root through the Open vSwitch datapath, even on hosts with no obvious OVS service running. The standard check of “ovs-vswitchd is absent” misses the kernel path and the automatic module-load route, so a system can still be exposed when the datapath is present and unprivileged user namespaces are enabled.

The flaw is CVE-2026-64531, a memory corruption bug in the Linux kernel’s Open vSwitch datapath. Public disclosure includes a working PoC and prebuilt records for roughly 800 kernel builds, and the first fixed upstream releases are 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5.

This lowers the bar for local privilege escalation across many default Linux distributions. If the datapath is available, the attack path stays practical until vendor kernels pick up the fix or the module is kept out of reach.

CVE-2026-64531

NVD KEV

Microsoft patch: CBL-Mariner Releases.

Timeline

Aug 5 Reported by The Hacker News

Sources

1 source covering this story

The Hacker News Aug 5
New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch
CVE-2026-64531 lets local users exploit Open vSwitch kernel memory corruption to gain root, with a public PoC covering roughly 800 builds.

Entities

CVE-2026-64531

Part of the PlainSec briefing for 2026-08-06

Editions

Vulnerabilities · 54 days agoLocal Linux Users Can Reach Root Through OVS DatapathOrdinary local users can now reach kernel root through the Open vSwitch datapath, even on hosts with no obvious OVS service running. The standard check of “ovs-vswitchd is absent” misses the kernel path and the automatic module-load route, so a system can still be exposed when the datapath is present and unprivileged user namespaces are enabled.The flaw is CVE-2026-64531, a memory corruption bug in the Linux kernel’s Open vSwitch datapath. Public disclosure includes a working PoC and prebuilt records for roughly 800 kernel builds, and the first fixed upstream releases are 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5.This lowers the bar for local privilege escalation across many default Linux distributions. If the datapath is available, the attack path stays practical until vendor kernels pick up the fix or the module is kept out of reach.