A newly disclosed Linux kernel vulnerability, known as OVSwrap, enables unprivileged local users to elevate their privileges by exploiting an integer wraparound bug in the Open vSwitch kernel module This article explores vulnerability known ovswrap. . Security researcher Asim Viladi Oglu Manizada reported this flaw on July 28, 2026, following a coordinated embargo with the Linux kernel security team and distribution maintainers.
By crafting a crafted CLONE action with hundreds of small conntrack actions, an attacker can push a single nested attribute past 65,535 bytes, leading to the stored length wrapping around to a small value.
The exploit unfolds in clear stages: a fake OUTPUT action is planted at the wrapped offset with an inflated declared length, causing OVS to leak adjacent kernel data, including a real FTP conntrack-helper pointer, back to userspace when the flow is dumped. Repeated decrements target a process's credential structure, zeroing out fsuid and fsgid or wrapping capability bits on older kernels, ultimately granting root access on the host. Triggering this bug requires only CAP_NET_ADMIN inside an attacker-controlled network namespace, achievable with a single unshare command on systems with unprivileged user namespaces enabled, without needing pre-existing OVS bridge or ovs-vswitchd processes.
Confirmed affected kernel series encompass 5.15.180 through 211, 6.1.132 through 177, 6.6.84 through 144, 6.12.20 through 96, and 6.18.0 through 39, with fixes in 5.15.212, 6.1.178, 6.6.145, 6.12.97, and 6.18.40.
