Linux OVS datapath bug yields local root via wrapped Netlink lengths

A local privilege-escalation flaw in the Linux kernel's Open vSwitch datapath, tracked as CVE-2026-64531 and dubbed OVSwrap, allows an unprivileged user to reach root code execution on systems that ship the OVS kernel module with conntrack support.

The bug is reachable whenever unprivileged user and network namespaces are enabled (the default on many distributions) or the attacker otherwise holds CAP_NET_ADMIN inside a namespace they control. AppArmor and SELinux do not stop the exploit once that capability is present. The same conditions make the issue potentially usable from a container, though a full escape was not confirmed by the reporter.

Open vSwitch accepts a userspace action list, then expands it into a larger internal action stream stored as Netlink attributes. Those attributes use a 16-bit length field. A change in March 2025 dropped an earlier 32 KiB ceiling on the generated stream, so the total size can legitimately exceed 64 KiB while individual nested attributes still lack an overflow check.

An attacker supplies a valid outer action, such as a clone, packed with hundreds of small conntrack actions. The kernel expands the clone past 65 535 bytes; the length field wraps to a small value. Later dump and free paths trust the truncated length and resume parsing inside the attacker-controlled conntrack data. Labels and timeout names planted there become forged output and set actions, giving a pointer leak, an arbitrary kernel read, and a targeted decrement that the proof-of-concept turns into full control.

The fix, which simply rejects oversized nested action attributes, reached stable kernels 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40 and 7.1.5 after an embargo coordinated with linux-distros. Systems that load the OVS datapath should pick up those updates promptly.