Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2026-79619

OpenZFS: user-namespace capability check allows unprivileged local authorization bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
canonical

Description

On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OpenZFS OpenZFS

Default version status: unaffected

  • 0.7.0 to < 2.2.11affected
  • 2.3.0 to < 2.3.9affected
  • 2.4.0 to < 2.4.4affected

References