New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch

A memory corruption flaw in the Linux kernel's Open vSwitch datapath gives ordinary local users a path to root on a broad set of default-configured distributions, and a public exploit ships with pre-built records for roughly 800 kernel builds. The vulnerability, tracked as CVE-2026-64531 (CVSS score: 7.8) and codenamed OVSwrap by its discoverer, was disclosed by security researcher Asim

According to the article and supporting sources, OVSwrap (CVE-2026-64531) is a Linux kernel Open vSwitch datapath vulnerability that allows unprivileged local users to escalate to root on many default Linux distributions by abusing an integer length-field wraparound in Netlink action processing.[1][2][7] A reliable public exploit exists and comes pre-tuned for hundreds of kernel builds, and the bug affects a wide range of kernel series commonly shipped by major distros until recent security updates.[1][2][3] From a RealGround perspective, any AI infrastructure (or AI agents) running on affected Linux hosts is at high risk of full compromise, because a low-privilege account (such as a service user or container tenant) can gain root, tamper with AI models, training data, secrets, and SBOMs, or subvert agent behavior; organizations should inventory kernels and modules, apply vendor patches, and consider hardening measures like disabling unprivileged user namespaces or unloading the openvswitch module where feasible.[3][4][6] This flaw is a critical AI supply chain issue: it undermines host integrity assumptions for AI workloads and demands coordinated kernel patching and configuration