A public proof of concept for CVE-2026-64531, dubbed OVSwrap, gives local users root access on Linux hosts with Open vSwitch and conntrack kernel support. Administrators need to identify both kernel paths and verify that the running kernel contains the fix.
CIQ published its guidance on July 27. Sixteen days later, pre-derived offsets for approximately 760 kernel builds keep the exploit easy to reproduce. The sources do not quantify hosts with both required paths. A local user can reach the flaw through private namespaces; a container with CAP_NET_ADMIN can use an attacker-controlled network namespace. DPDK-based userspace datapaths are outside this kernel path.
Nested action length corrupts kernel memory
The kernel.org CNA description carried by NVD places the bug in Open vSwitch’s handling of generated flow actions. Those actions are encoded as Netlink attributes. Each attribute has a 16-bit nla_len field, even though the complete action stream can legitimately exceed 64 KiB.
The length field is only 16 bits.
An earlier kernel change allowed large action streams but removed the last guard against an oversized nested attribute. With Open vSwitch and conntrack present, nested CLONE and CT actions can exceed the 16-bit representation and corrupt memory.
CIQ support engineer Arsalan Zaidi describes the result: “A local unprivileged user can trigger an integer overflow in the OVS nested action length field, corrupt kernel memory, and escalate to root.” The exploit creates a datapath in a private network namespace, changes process credentials, and writes a passwordless-root rule under /etc/sudoers.d/.
Figure details
The exploit first requires both Open vSwitch and conntrack kernel module support. An unprivileged local process can create private user and network namespaces where the host allows it; a container with CAP_NET_ADMIN can instead control its network namespace directly. Crafted Open vSwitch CLONE and CT actions grow a nested Netlink attribute beyond the 16-bit length field. The mismatch corrupts kernel memory, which the public exploit converts into root credentials and a sudoers persistence file.
Scope the reachable Open vSwitch path
Establish whether Open vSwitch is active or available, whether conntrack is present, and whether the running kernel contains the fix. lsmod | grep -E '^(openvswitch|nf_conntrack)' identifies resident modules; modinfo openvswitch and modinfo nf_conntrack test availability. Record uname -r rather than treating an installed update as remediation.
The running kernel decides the result.
Inventory hypervisors, SDN and container nodes, appliances, development systems, and recovery images. A host may expose an auto-loadable module without intentionally running Open vSwitch. DPDK-only deployments remain outside this kernel path.
Apply the distribution fix and reboot. CIQ lists kernel-5.14.0-687.29.1+2.1.el9_8_ciq for RLC Pro 9 and SIG/Cloud Next 9; kernel-6.12.0-211.37.1+2.1.el10_2_ciq for their 10-series counterparts; clk6.12-6.12.97-1.1.el9_clk for CIQ Linux Kernel LT 6.12; and clk6.18-6.18.40-1.1.el9_clk for version 6.18. CIQ excludes Rocky Linux 8-based variants, CIQ LTS 9.2, 9.4, and 9.6, and CIQ Bridge. Rocky Linux 9 and 10 community users need the applicable Rocky errata. uname -r must report the fixed or newer same-channel build.
Block unused Open vSwitch modules
CIQ’s guidance recommends blocking the module when kernel Open vSwitch is unused, then rebooting to remove any resident copy. An install openvswitch /bin/false override rejects explicit and automatic load requests.
That control has real operational costs.
The control breaks kernel-backed OVS, OVN, and dependent virtual networking. Confirm the network design before fleet deployment.
When OVS must remain, user.max_net_namespaces=0 blocks the unprivileged local route. sysctl user.max_net_namespaces must then return zero. This can break rootless containers and application sandboxes, and it does not stop a container with CAP_NET_ADMIN; remove that capability or block the module.
If Open vSwitch is unnecessary, verify both sides of the module block after reboot: lsmod | grep openvswitch should return no output, and sudo modprobe -n -v openvswitch should resolve to install /bin/false rather than a .ko path. A loaded module or a .ko resolution means the temporary control has not closed the path.
Check the public exploit artifacts
There is no campaign-specific network indicator in the cited primary records, and neither source reports active exploitation. The public proof of concept nevertheless leaves observable state that defenders can check.
Those artifacts support immediate triage.
Inspect /etc/sudoers.d/ for unexpected NOPASSWD access and use lsns -t net to find private namespaces held by unfamiliar processes. Correlate findings with process starts, audit logs, and Open vSwitch or memory-corruption kernel messages.
These are proof-of-concept behaviors rather than universal indicators. Missing telemetry cannot clear a host. If suspicious state appears, isolate it, preserve volatile evidence, rebuild from trusted media, and rotate reachable secrets.
A patched kernel leaves history open
Remediation has a machine-checkable boundary. Every in-scope host with Open vSwitch and conntrack support must boot a distribution kernel carrying the CVE-2026-64531 fix or keep the Open vSwitch kernel module verifiably unavailable. Confirm the running kernel after reboot. For temporary controls, record the expected result: no loaded Open vSwitch module plus an install /bin/false dry-run resolution, or a namespace sysctl of zero for the local-user path only. Record any capability restriction and its operational side effects.
Exposure requires a separate record of unexpected sudoers files, private network namespaces, unprivileged namespace creation, containers with CAP_NET_ADMIN, OVS-related kernel events, and anomalous root or child-process activity across the period when the module was reachable. If evidence is incomplete or unexplained privileged state exists, rebuild the host and rotate reachable secrets.
A patched kernel prevents the next attempt; it cannot retroactively attest to the old one.