CVE-2026-79619
On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host pri…
Impact
On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/advisories/GHSA-mhf5-q8gw-qg9v
- https://github.com/openzfs/zfs/pull/18959
- https://github.com/openzfs/zfs/releases/tag/zfs-2.2.11
- https://github.com/openzfs/zfs/releases/tag/zfs-2.3.9
- https://github.com/openzfs/zfs/releases/tag/zfs-2.4.4
- https://seclists.org/fulldisclosure/2026/Aug/40