CVE-2026-64531 — OVSwrap

Linux kernel Open vSwitch module local privilege escalation (normal user → root) PoC. Exploits the integer wraparound of the 16-bit nla_len field to escalate from a normal user all the way to root.

Vulnerability Summary

When the nested action stream generated by OVS exceeds 65535 bytes, the 16-bit nla_len field wraps around. An attacker holding only CAP_NET_ADMIN in a private user/network namespace can craft an oversized CLONE action, causing the kernel parser to fall into attacker-controlled conntrack data, thereby gaining arbitrary kernel read and word-by-word decrement primitives, ultimately tampering with its own credentials to escalate to root.

The bug stems from an unsafe assignment that has existed for 13 years (commit 74f84a5726c7), previously protected by a 32 KiB total length limit; it was activated in March 2025 after commit a1e64addf3ff removed the limit.

• Vulnerability ID: CVE-2026-64531
• Type: Local privilege escalation (LPE)
• Affected Component: Linux kernel openvswitch module
• Trigger Prerequisite: normal user + unshare -Urn (no initial namespace privileges required)

Affected / Fixed Versions

The 6.13–6.17, 6.19, and 7.0 series are EOL and have no fixes.

Requirements

• Linux x86-64, running an affected/unpatched kernel
• OVS conntrack support + FTP conntrack helper
• Unprivileged user namespaces available (unshare -Urn), sudo installed
• Python 3.7+
• 2 GiB+ RAM recommended

Usage

# 必须以普通(非 root)用户运行
python3 ovswrap-poc.py

The script automatically runs unshare -Urn into a private user+network namespace; it includes a pre-derived offset table for approximately 800 x86-64 kernel builds, and when no match is found it attempts dynamic derivation from System.map / BTF / pahole. On success, it obtains a passwordless root shell by writing an entry to /etc/sudoers.d/.

⚠️ Disclaimer

For security research, vulnerability validation, and defensive testing only. This PoC will corrupt kernel credentials, modify the sudoers file, and leave behind zombie processes and damaged OVS state — run it only in a disposable virtual machine; do not run it in production or unauthorized environments.

Attribution and References

• Original PoC: manizada/OVSwrap (GPL-2.0), this repository is a distribution mirror
• Technical analysis: https://heyitsas.im/posts/ovswrap/
• Fix commit: 3f1f755366687d051174739fb99f7d560202f60b