OVSwrap Linux Kernel LPE (CVE-2026-64531) Has Public PoC for 800+ Builds

Wed, 05 Aug 2026 13:01:27 +0000

Engineer — Act: A public PoC targeting ~800 specific kernel builds makes exploitation practical now even without KEV listing; patch the Linux kernel to a fixed version on any host running Open vSwitch, which is the default datapath in most cloud and Kubernetes environments.
SOC/IR — Plan: No active in-the-wild exploitation yet (EPSS 0.00), but the wide-coverage PoC means post-initial-access LPE attempts could emerge quickly; build or tune EDR behavioral detections for unexpected privilege escalation from low-privilege processes touching OVS kernel interfaces.
Leader — Skip
Signals: CVE-2026-64531 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub

Open-Vswitch on CuraSec