Affected Systems

Linux kernel Open vSwitch datapath. Fixed in stable kernels 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. Affects default configurations of AlmaLinux 9/10, Alpine 3.22-3.24, Amazon Linux 2023, Arch, CentOS Stream 9/10, Debian 12/13, Fedora 42-44, Gentoo, Kali 2026.1, Linux Mint 22.3, NixOS, openSUSE Tumbleweed, Pop!_OS, Rocky Linux 9/10, Ubuntu 22.04. Ubuntu 24.04 exploitable with AppArmor bypass; Ubuntu 26.04 blocked by default. Amazon Linux 2, Debian 11, Rocky Linux 8, Ubuntu 20.04 not exploitable via this route.

Exploitation Status

Public exploit released with pre-built records for approximately 800 kernel builds. Proof-of-concept demonstrates reliable local privilege escalation from unprivileged user to root on default-configured systems. No active in-the-wild exploitation reported yet.

Business Impact

Local unprivileged users can gain root privileges on systems with OVS kernel datapath available and unprivileged user namespaces enabled. No existing OVS bridge or running ovs-vswitchd required; module auto-loads on vulnerable systems. Critical risk in multi-tenant environments, shared hosting, or where untrusted users have local access. An attacker who compromised one user account can escalate to full system control. Exploit requires OVS conntrack support, FTP conntrack helper, and sudo installed. Exploit is destructive and corrupts kernel credentials.

Urgency

🔴 Immediate

Recommended Actions

  • Apply vendor-provided patched kernels immediately (Linux 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5 or later; consult distribution security advisories for backported fixes).
  • If Open vSwitch is not required, block openvswitch module loading with: echo 'install openvswitch /bin/false' > /etc/modprobe.d/ovswrap.conf, then unload existing module with rmmod openvswitch or reboot.
  • Disable unprivileged user namespaces as interim mitigation: sysctl -w kernel.unprivileged_userns_clone=0 (note: does not protect against containers with CAP_NET_ADMIN).
  • Monitor for unexpected openvswitch module loads and namespace creation by unprivileged users in auditd or system logs.
  • Prioritize patching on multi-tenant systems, shared hosting platforms, and any environment where untrusted local users exist.