Back Feeds.4Sysops

OVSwrap root exploit can reach Linux hosts even when Open vSwitch is idle

Feeds.4Sysops •IT News • August 5, 2026

A public exploit for CVE-2026-64531, the Linux kernel Open vSwitch flaw known as OVSwrap, includes offsets for roughly 800 x86-64 kernel builds. The module can also be loaded automatically when an attacker probes its Generic Netlink interface, so an empty `lsmod` result does not prove that a host is safe. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical OVSwrap Flaw in Linux Kernel Allows Local Root Access A 13-year-old vulnerability, CVE-2026-64531, known as OVSwrap, has been disclosed, allowing local users to gain root privileges on various Linux distributions using Open vSwitch. Security researcher Asim Manizada revealed that the flaw affects a wide range of systems and has a CVSS score of 7.8. A public exploit is available, which includes offsets for approximately 800 x86-64 kernel builds. The exploit can be triggered even when Open vSwitch is idle, making detection difficult. This vulnerability poses a significant risk to systems running affected kernel versions. The flaw was published on July 27, 2026, with the first proof of concept released shortly after on July 29. Organizations using Linux distributions with Open vSwitch are urged to assess their systems for this vulnerability. 5 sources 69

Extracted Entities

OVSwrap root exploit can reach Linux hosts even when Open vSwitch is idle

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (2)

Vulnerabilities (1)