New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch

CVE-2026-64531 (OVSwrap) is a memory corruption vulnerability in the Linux kernel's Open vSwitch (OVS) datapath. OVS stores generated flow actions as Netlink attributes with a 16-bit nla_len field, capping any single nested attribute at 65,535 bytes. A historical 32 KiB cap on the total generated action stream prevented exploitation, but a March 2025 kernel change removed that cap for reliability reasons, re-exposing a 13-year-old truncation bug. An attacker submits a CLONE action packed with hundreds of conntrack sub-actions; on x86-64 each expands to 164 bytes, pushing the nested action past 65,535 bytes and causing the 16-bit length field to wrap. Later kernel code trusts the wrapped length and resumes parsing from inside attacker-controlled conntrack data containing forged OVS actions. Because the landing point is deterministic within the same contiguous buffer, no heap grooming is required. The exploit chains three primitives: a kernel pointer leak via a fake OUTPUT action, an arbitrary kernel read via a forged tunnel SET action, and a targeted decrement via teardown of a forged tun_dst pointer. These are used to locate a host process's credentials and decrement fsuid and fsgid to zero on modern kernels. Exploitation requires unprivileged user namespaces to be enabled; an ordinary user can use 'unshare -Urn' to create private user and network namespaces, gain CAP_NET_ADMIN inside that namespace, and reach the vulnerable flow-installation path. If the openvswitch module is installed but not loaded, resolving its Generic Netlink family name can auto-load it. The released PoC requires OVS conntrack support, the FTP conntrack helper, and sudo to be installed. On success it corrupts a live kernel credential, modifies /etc/sudoers.d or /etc/sudoers, and opens a root shell. The PoC includes pre-built records for ~800 x86-64 kernel builds and dynamic derivation from symbols or BTF for uncovered builds. On Ubuntu 24.04, an AppArmor fallback using 'aa-exec -p trinity' was used to bypass namespace restrictions.