A newly disclosed flaw in the Linux kernel’s Open vSwitch component lets unprivileged local users obtain root privileges, prompting urgent patch advice across major distributions. The issue was brought to light by researcher Asim Manizada, who published a detailed analysis on his blog.
The vulnerability tracked as CVE-2026-64531 carries a CVSS score of 7.8 and resides in the OVSwrap function handling action streams. A recent kernel change removed a 32 KiB limit, allowing attackers to craft CLONE actions that bypass validation and trigger privilege escalation as reported by SecurityAffairs.
Researcher Asim Manizada released a proof‑of‑concept showing the flaw works on default installations of Fedora, Debian and several other distros that ship the vulnerable kernel versions. The issue has been present for roughly thirteen years, remaining hidden until the limit was lifted per TheHackerNews.
To date no active exploitation has been observed in the wild and no threat actor has been linked to the bug. However the public release of exploit code raises the chance that attackers will try to use it on exposed systems, especially those with permissive local user policies.
Administrators are advised to apply the latest kernel patches supplied by their distribution as soon as possible. If immediate updating is not feasible, loading of the Open vSwitch module can be disabled to block the attack vector while a fix is prepared.
Systems should also review local user accounts, enforce least privilege principles and monitor logs for unexpected attempts to elevate privileges. Keeping subsystems up to date and restricting unnecessary kernel modules remain core hardening measures.