Bottom line: A vulnerability dubbed OVSwrap (CVE-2026-64531, CVSS 7.8) in the Linux kernel’s Open vSwitch datapath allows local users to gain root privileges using an already publicly available exploit prepared for around 800 kernel builds.
A memory corruption issue in the Linux kernel’s Open vSwitch datapath allows ordinary local users to seize root privileges. A public exploit with prebuilt attack data for roughly 800 kernel builds makes exploitation practical and significantly lowers the barrier to entry.
The vulnerability is tracked as CVE-2026-64531 with a CVSS score of 7.8 and carries the codename OVSwrap, assigned by its discoverer. Affected is the Open vSwitch datapath in the Linux kernel, which is enabled in many default configurations. The vulnerability was publicly disclosed by researcher Asim. An already available exploit contains prebuilt records for around 800 different kernel builds, making the vulnerability exploitable across a wide range of Linux distributions without requiring any individual adaptation work.
For CISOs, it is relevant that this is a local privilege escalation vulnerability: an attacker first needs an initial foothold, for example via a compromised user account, a malicious container workload, or another already successful initial compromise. From this starting point, however, the flaw can be leveraged to obtain full root privileges on the host. Since Open vSwitch is widely deployed in virtualized environments, cloud infrastructures, and container networks, this potentially affects a significant number of production systems, particularly in data centers and at cloud providers relying on software-defined networking.
The combination of broad distribution coverage, prebuilt exploit material for around 800 kernel versions, and the fact that Open vSwitch is often active by default increases the practical risk compared to many other local privilege escalation flaws. Security teams should check whether Open vSwitch is deployed in their environment, identify affected kernel versions, and promptly apply available patches from their respective distributors. Where immediate patching is not possible, it is advisable to review access controls on hosts using Open vSwitch and to increase monitoring for unusual local privilege escalation attempts.
Source: thehackernews.com · Published August 5, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.