Linux Kernel — OVSwrap: Open vSwitch Conntrack Local Privilege Escalation (CVE-2026-64531)

CVE-2026-64531 is a memory corruption vulnerability in the Linux kernel Open vSwitch (OVS) conntrack subsystem. The exploit, named OVSwrap, uses OVS Generic Netlink operations to corrupt conntrack timeout and labels carrier objects, establishing kernel read and write primitives. These primitives are then used to write a sudoers entry for the running user, granting passwordless root access.

The exploit is a single Python file (2,155 lines) that embeds pre-derived kernel offset tables for multiple distribution kernels (base85-compressed JSON). For uncovered kernels, it can dynamically derive offsets from locally readable BTF files, System.map, or /proc/kallsyms using pahole.

Root Cause

The OVS kernel module processes conntrack actions via Generic Netlink. A vulnerability in the conntrack timeout/labels carrier handling allows an attacker to corrupt kernel memory through carefully crafted OVS flow operations. The exploit uses two carrier types (timeout and labels-only) to achieve controlled read and write access to kernel memory.

Exploitation Process

1. Refuse root: The exploit verifies it is running as an unprivileged user without sudo access or effective capabilities.
2. Kernel record lookup: Checks the running kernel against an embedded table of pre-derived offsets. Falls back to dynamic derivation via BTF/pahole/System.map if not covered.
3. Namespace isolation: Creates private user and network namespaces via unshare -Urn (with AppArmor aa-exec -p trinity fallback on Ubuntu).
4. OVS datapath creation: Sets up a private OVS datapath and flows via Generic Netlink.
5. Conntrack corruption: Sends crafted conntrack actions to corrupt carrier objects, establishing kernel memory read/write primitives.
6. Sudoers write: Uses the write primitive to add a sudoers entry granting the running user passwordless root.
7. Root shell: Spawns sudo -n bash to obtain a root shell.

Impact

Local privilege escalation from unprivileged user to root via sudoers policy modification. Requires the OVS kernel module to be loaded.

See ovswrap-poc.py (2,155 lines, Python 3) in this folder – mirrored byte-for-byte from HackSpeak/CVE-2026-64531. The upstream README is preserved as upstream-README.md.

Step-by-Step Reproduction

1. Ensure OVS module is loaded: lsmod | grep openvswitch
2. Run as unprivileged user: python3 ovswrap-poc.py
3. Acknowledge dynamic derivation if kernel is not in the pre-derived table.
4. Observe: The exploit creates namespaces, establishes read/write primitives, writes a sudoers entry, and spawns a root shell.

Exploit Code

Kernel record lookup and namespace entry:

1
2
3
4
5
6
7
8
9

def lookup_kernel_build_record() -> KernelBuildRecord | None:
    uname = os.uname()
    records = load_kernel_build_records()
    exact_matches = [
        record for record in records
        if record.release == uname.release
        and record.version == uname.version
        and record.machine == uname.machine
    ]

Sudoers write for privilege escalation:

1
2
3
4

def spawn_root_shell(username: str) -> None:
    sudo = checked_binary("sudo")
    shell = shutil.which("bash") or "/bin/bash"
    result = subprocess.run([sudo, "-n", shell], check=False)

Expected Output

***CHECKING BASELINE SUDO ACCESS***
baseline passwordless sudo for user: denied

***ENTERING PRIVATE USER AND NETWORK NAMESPACES***
namespace: direct unshare -Urn works

[exploit stages...]

RESULT: sudoers policy write achieved; spawning 'sudo -n /bin/bash' as user
root@host:~#

• NVD – CVE-2026-64531
• HackSpeak/CVE-2026-64531 (upstream PoC)
• Blog post: OVSwrap

Verified this session by reading the full exploit source (ovswrap-poc.py, 2,155 lines, first 1,033 lines in detail). The exploit is a single Python file using only standard library modules plus raw AF_NETLINK sockets for Generic Netlink communication. The embedded kernel offset table is base85-encoded, zlib-compressed JSON containing pre-derived structure offsets and symbol addresses for multiple distribution kernels.

Malware screen – clean. No obfuscated code, no remote downloaders, no credential exfiltration, no miners, no callbacks. The only persistence mechanism is the sudoers write (the intended exploitation outcome). All external process invocations are to standard system utilities (unshare, sudo, bash, pahole, aa-exec). The exploit explicitly refuses to run as root or with existing capabilities.

Author: HackSpeak describes itself as a “community PoC mirror” with 6 stars on this repo. The code references a blog post at heyitsas.im/posts/ovswrap for the full vulnerability analysis. Lower author confidence than the other entries but the code is legitimate, well-structured exploit research.