Local Linux Users Can Reach Root Through OVS Datapath
Ordinary local users can now reach kernel root through the Open vSwitch datapath, even on hosts with no obvious OVS service running. The standard check of “ovs-vswitchd is absent” misses the kernel path and the automatic module-load route, so a system can still be exposed when the datapath is present and unprivileged user namespaces are enabled.
The flaw is CVE-2026-64531, a memory corruption bug in the Linux kernel’s Open vSwitch datapath. Public disclosure includes a working PoC and prebuilt records for roughly 800 kernel builds, and the first fixed upstream releases are 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5.
This lowers the bar for local privilege escalation across many default Linux distributions. If the datapath is available, the attack path stays practical until vendor kernels pick up the fix or the module is kept out of reach.