OVSwrap (CVE-2026-64531) already fixed in security repository for Rock 9 and 10?

Rocky Linux Help & Support
1

As there was no announcement, is OVSwrap already fixed in Rocky 9 and 10 with the latest kernels in the security repository?

The versions like kernel-5.14.0-687.31.1.el9_8.0.1.x86_64.rpm are already higher than the CIQ versions.

2

Hi,
I do not know of a fix being made available ahead of RHEL, but there are mitigation options:

  • Disable at least unprivileged network namespaces.
  • Presuming it is not needed, disable the kernel module used in the published exploit, see below.
modprobe -r openvswitch || echo A reboot is needed for this mitigation to work

cat >/etc/modprobe.d/mitigation-cve-2026-64531.conf <<'EOF'
blacklist openvswitch
install openvswitch /bin/false
EOF
3

Thank you, I am already aware of the mitigation options, I just wanted to know if these kernel versions are already patched. The minor version numbers are higher than the CIQ versions already announced and the date also would indicate that, but there is no update anywhere from Rocky/CIQ.

4

The stock rocky kernels are not patched, but, if you enable the new security repo, the latest kernels there do have the OVSwrap fix, thanks to the CIQ kernel engineers.

For 9:

$ rpm -q --changelog kernel-5.14.0-687.31.1.el9_8.0.1.x86_64 | head -n 5
* Tue Jul 28 2026 Jonathan Dieter <jdieter@resf.org> - 5.14.0-687.31.1.0.1
- net: openvswitch: reject oversized nested action attrs (Sultan Alsawaf) {CVE-2026-64531}

* Tue Jul 28 2026 Release Engineering <releng@rockylinux.org> - 5.14.0-687.31.1
- Replace sbat with Rocky Linux sbat (label)

For 10:

$ rpm -q --changelog kernel-6.12.0-211.40.1.el10_2.0.2.x86_64 | head -n 5
* Wed Jul 29 2026 Jonathan Dieter <jdieter@resf.org> - 6.12.0-211.40.1.0.2
- Bump for rebuild against correct llvm

* Tue Jul 28 2026 Jonathan Dieter <jdieter@resf.org> - 6.12.0-211.40.1.0.1
- net: openvswitch: reject oversized nested action attrs (Sultan Alsawaf) {CVE-2026-64531}

8 was never vulnerable.