Cybersecurity Announcement: Linux Kernel Privilege Escalation to Root Vulnerability - OVSwrap (CVE-2026-64531)
About the Event
On July 28, 2026, security researcher Asim Manizada published details and proof-of-concept for a privilege escalation to root vulnerability within Linux’s Open vSwitch (OVS). The vulnerability is being tracked as CVE-2026-64531 and is also known as OVSwrap.
Actions to Consider
Most major Linux distributions are affected, including Debian 12 and later, RedHat variants, and Ubuntu since 22.04. The OVS module does not need to be active for a system to be vulnerable.
Cybersecurity recommends reviewing the distro impact tables in the OVSwrap reference link below for further details on vulnerable distributions and patching the kernel when fixes become available.
If your distribution has not yet published fixes, the following is recommended:
-
Unload and Blocklist OVS if not needed
-
Disable unprivileged user namespaces
-
Additional mitigations can be found in the wisc git reference
Event Impact
Any low-privilege user on a vulnerable system where user namespace is enabled can exploit this vulnerability and escalate to root privileges on the host machine. A public proof-of-concept is available, though there is no current evidence of active exploitation in the wild.
References
https://heyitsas.im/posts/ovswrap/
https://git.doit.wisc.edu/engr/cae/public-tools/mitigations/ovswrap-mitigations