This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Linux Kernel (KVM, Open vSwitch) fixes 2 high-severity vulnerabilities

Linux Kernel fixes 2 vulnerabilities affecting the KVM subsystem and the Open vSwitch module. KVM is affected by the vulnerability described below from Kernel version 5.9 [1], or from versions where the code from commit f95eec9bed76 was backported [2], and the fix is in commit 2abd5287f083 [3]. Debian has released a fix in 6.12.101-1 for trixie (security), in 7.1.6-1 for forky and in 7.1.7-1 for sid [4]. Available fixes for Red Hat products can be found at [5]. Open vSwitch is affected by the vulnerability described below from versions 5.15.180, 6.1.135, 6.6.90, 6.12.20, 6.18.1, 7.1.0 (commit a1e64addf3ff [6]) and the fix is in versions 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5 (commit 3f1f75536668 [7]) [8]. Ubuntu does not yet have a fix for releases 22.04 - 26.04; the other releases are not affected by the vulnerability [9]. Available fixes for Red Hat products can be found at [10]. Individual Debian releases and their fixed versions (CVE-2026-64531) [11]: bullseye (security 6.1) - 6.1.180-1~deb11u1 bookworm (security) - 6.1.180-1 bookworm (security 6.12) - 6.12.100-1~deb12u1 trixie (security) - 6.12.101-1 forky - 7.1.6-1 sid - 7.1.7-1

Linux Kernel (KVM) - guest-to-host escape (CVE-2026-64561)
CVSS 7.0 (High)

An authenticated local attacker can use the Linux Kernel KVM subsystem to escape from the guest operating system to the host operating system and gain root rights on it [12]. A PoC is available at [13]. To exploit the vulnerability, nested virtualization must be enabled and the attacker must have Kernel L1 privileges in the guest operating system. Additional conditions for exploiting the vulnerability on the Intel architecture can be found at [14]. Temporary mitigation options are described at [15], but they are based on the exploitation conditions.

CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 4. 8. 2026.

Linux Kernel (Open vSwitch) - LPE (CVE-2026-6453)
CVSS 7.8 (High)

An authenticated local attacker can use the Linux Kernel Open vSwitch module to escalate privileges to root [16]. A PoC is available at [17], but it leaves destructive changes behind after being run. To exploit the vulnerability, unprivileged user namespaces must be enabled [16]. Temporary mitigation options are described at [18], but they are based on the exploitation conditions.

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 28. 7. 2026.

By CESNET, z.s.p.o. Martin Krajči on 7. 8. 2026.

CESNET, z.s.p.o. Logo