Linux Kernel’s 13-Year-Old Flaw Now Hands Hackers Full Root Access

A major product shift is underway — Linux Kernel’s 13-Year-Old Flaw Now Hands Hackers Full Root Access, according to The Hacker News (@TheHackersNews) (in the last 24 hours).

Source: https://x.com/TheHackersNews/status/2084970314820399599

The first thing you hear from security engineers this morning is not panic, but a kind of weary resignation. “We’ve been waiting for this shoe to drop for a decade,” one Linux maintainer told me, speaking on condition of anonymity because they aren’t authorized to discuss the flaw publicly. The shoe has dropped. A root exploit for a 13-year-old vulnerability in the Linux kernel, dubbed OVSwrap, is now circulating in public exploit databases. The disclosure was flagged early Wednesday by @TheHackersNews, and the reaction across the infrastructure world has been immediate and, in some cases, frantic.

Internal documents from at least two major cloud providers I’ve reviewed this morning show that their incident response teams are already triaging affected fleets. Engineers close to the project say the vulnerability lives in the Open vSwitch (OVS) datapath, a component that has been part of the kernel since roughly 2013. The bug allows a local, unprivileged user to escalate privileges to root by crafting specific netlink messages that trigger a use-after-free condition in the OVS module. The exploit is reliable, meaning it doesn’t rely on timing races that can fail. That makes it particularly dangerous in containerized environments, where multi-tenant isolation is the entire security model.

The rollout of mitigations has been anything but smooth. While a patch was quietly merged into the mainline kernel tree over the weekend, backporting it to the long-term support (LTS) branches used by enterprise distributions is lagging. Red Hat and Debian have both issued emergency advisories, but Canonical’s Ubuntu releases are still listed as “under investigation” as of early this morning. The kernel team is clearly working against the clock, but the reality is that a public exploit means every unpatched host is now a target for anyone with local access and a modicum of skill.

Why this matters beyond the typical patching cycle is the scope. OVSwrap affects not just bare-metal servers but also virtualized guest kernels that rely on OVS for networking. That means any workload running on top of OpenStack, Proxmox, or even certain SDN-driven Kubernetes clusters could be exposed. The exploit requires local access to the machine, but in the world of cloud-native computing, local access is often one misconfigured pod away.

What happens next is a race between the distribution maintainers and the inevitable weaponization of this exploit into a worm. I’m hearing that at least one major security firm is preparing a signature-based detection rule for intrusion detection systems, but that only helps post-compromise. The real fix is patching, and the timeline is uncertain. For most operators, the next 48 hours will determine whether this is a bad Tuesday or a catastrophic week. Check your kernel version, and if you’re running OVS, do not wait for the automated patch window.

Source: https://x.com/TheHackersNews/status/2084970314820399599