This was reported today on The Hacker News:
when I checked the kernel version on my laptop running PureOS Crimson, it was 6.1.177 - so having this critical flaw (CVSS score: 7.8)
A security update appeared today, bumping the kernel to 6.1.180-1
Even if you don’t have OpenvSwitch package installed, the module is present and could be dynamically loaded by the kernel under certain conditions - this is why you should update now.
This is the latest of a series of local root exploits that use container capabilities. The above is a blog post I wrote about one of the recent ones and how SE Linux stopped it. In theory you could run a system without any extra security features and just disable user namespaces but many programs use them for various things, image viewers is one common example and libraries to load web pages. Kmail, Evolution, and Thunderbird all use containers so you need them for convergence. If you use a Debian phone just as a phone then you probably want Geary for email which uses webkit and uses bubblewrap for containers for web pages.
If you run SE Linux with the user login as user_t then you will be mostly safe from this class of exploits. It should be possible to configure apparmor to give the same result.
There’s probably going to be a dozen more local root exploits similar to this before the end of the year.