THE OVSwrap local root vulnerability, identified as CVE-2026-64531, allows unprivileged users to gain root access on various Linux systems through the Open vSwitch (OVS) datapath. The flaw exploits a change in action stream limits, enabling crafted CLONE actions to bypass security checks. It affects numerous Linux distributions and specific kernel versions prior to patches that have been released.
No confirmed exploitation has occurred yet, but the potential for attack exists, especially in default-configured systems. Users are urged to update their kernels or take mitigation steps if updating is not yet feasible. Critical systems utilizing OVS should prioritize these actions to avoid possible exploitation.