An open vSwitch flaw in the Linux kernel's datapath allows local users to gain root access across a variety of default-configured distributions This article explores vswitch flaw linux. . According to Manizada’s technical documentation, an intruder requires only that they do not possess any existing OVS bridges, are not running the ovs-vswitchd service, and lack host-level CAP_NET_ADMIN permissions.
If you're using an upstream fix that was released on July 24th in stable trees, and a patched vendor kernel isn't yet available, and Open vSwitch is unnecessary for your environment, consider unloading the module or rebooting if it's already loaded.
Manizada characterized the outcome as a memory corruption vulnerability with "logic-bug-grade reliability." The exploit chain leverages three key primitives from the wraparound: kernel pointer leakage via a fake OUTPUT action, an arbitrary kernel read through a forged tunnel SET action, and targeted decrements through teardown of a forged tun_dst pointer. Upon success, the exploit corrupts a live kernel credential, modifies `/etc/sudoers.d` or `/etc/sudoers`, opens a root shell, and leaves processes and OVS state behind to prevent unsafe teardown.
Manizada's non-exhaustive test matrix found default-config exploitation on tested AlmaLinux 9, 10, Alpine 3.22 through 3.24, Amazon Linux 2023, Arch, CentOS Stream 9 and 10, Debian 12 and 13, Fedora 42 through 44, Gentoo, Kali 2026.1, Linux Mint 22.3, NixOS, openSUSE Tumbleweed, Pop!_OS, Rocky Linux 9, 10, and Ubuntu 22.04.
