OpenZFS: user-namespace capability check allows unprivileged local authorization bypass
On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-79619
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 03:34 UTC · Revision 1
Source evidence
OpenZFS: user-namespace capability check allows unprivileged local authorization bypass
core-osv · Original sourcePublished 26 Aug 2026, 12:50 UTC
On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.
osv:CVE-2026-79619
Complete source record
{
"id": "e074689c09ab42435023a0b82f4e4b141f42b5800b8d0fb6c04da1b3a97a7d22",
"url": "https://osv.dev/vulnerability/CVE-2026-79619",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "OpenZFS: user-namespace capability check allows unprivileged local authorization bypass",
"summary": "On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.",
"evidence": "osv:CVE-2026-79619",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-79619",
"aliases": [
"CVE-2026-79619",
"GHSA-mhf5-q8gw-qg9v"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/openzfs/zfs",
"type": "GIT",
"events": [
{
"introduced": "ccad64314ab55963c1a0731ff62c8cf6c6976f28"
},
{
"fixed": "f2d87f5c724ccdbb27a11fb84c4a185e0a917598"
},
{
"introduced": "bc06d8164b8b6673ca2dc9b36090f91a5d6348b3"
},
{
"fixed": "4c0eb7203e5a2b147d1d5e27b5e2a3461a95c1dc"
},
{
"introduced": "743334913e5a5f60baf287bcc6d8a23515b02ac5"
},
{
"fixed": "71a9f9578616a90c3c14bb59629fb4d31bfd68d1"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0.7.0"
},
{
"fixed": "2.2.11"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.9"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "2.4.0"
},
{
"fixed": "2.4.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"fixed": "71a9f9578616a90c3c14bb59629fb4d31bfd68d1"
}
],
"source": "REFERENCES_TAG",
"original_tag": "zfs-2.4.4"
},
{
"range": [
{
"fixed": "4c0eb7203e5a2b147d1d5e27b5e2a3461a95c1dc"
}
],
"source": "REFERENCES_TAG",
"original_tag": "zfs-2.3.9"
},
{
"range": [
{
"fixed": "f2d87f5c724ccdbb27a11fb84c4a185e0a917598"
}
],
"source": "REFERENCES_TAG",
"original_tag": "zfs-2.2.11"
}
]
}
}
],
"versions": [
"zfs-2.3.8",
"zfs-2.4.3",
"zfs-2.2.10",
"zfs-2.4.2",
"zfs-2.3.7",
"zfs-2.4.1",
"zfs-2.3.6",
"zfs-2.4.0",
"zfs-2.2.9",
"zfs-2.3.5",
"zfs-2.3.4",
"zfs-2.2.8",
"zfs-2.3.3",
"zfs-2.3.2",
"zfs-2.3.1",
"zfs-2.3.0",
"zfs-2.2.7",
"zfs-2.2.6",
"zfs-2.2.5",
"zfs-2.2.4",
"zfs-2.2.3",
"zfs-2.2.2",
"zfs-2.2.1",
"zfs-2.2.0",
"zfs-2.2.0-rc5",
"zfs-2.2.0-rc4",
"zfs-2.2.0-rc3",
"zfs-2.2.0-rc2",
"zfs-2.2.0-rc1",
"zfs-2.1.0-rc1",
"zfs-2.1.99",
"zfs-2.0.0-rc1",
"zfs-0.8.0",
"zfs-0.8.0-rc5",
"zfs-0.8.0-rc4",
"zfs-0.8.0-rc3",
"zfs-0.8.0-rc2",
"zfs-0.8.0-rc1",
"zfs-0.7.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79619.json"
}
}
],
"modified": "2026-10-28T02:30:33.111728905Z",
"provider": "osv",
"references": [
"https://github.com/openzfs/zfs/releases/tag/zfs-2.2.11",
"https://github.com/openzfs/zfs/releases/tag/zfs-2.3.9",
"https://github.com/openzfs/zfs/releases/tag/zfs-2.4.4",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79619.json",
"https://github.com/advisories/GHSA-mhf5-q8gw-qg9v",
"https://nvd.nist.gov/vuln/detail/CVE-2026-79619",
"https://github.com/openzfs/zfs/pull/18959",
"https://github.com/openzfs/zfs",
"https://seclists.org/fulldisclosure/2026/Aug/40"
],
"provider_metadata": {
"cwe_ids": [
"CWE-863"
],
"cna_assigner": "canonical",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79619.json"
}
},
"related_cves": [
{
"value": "CVE-2026-79619",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 500039,
"published_at": "2026-08-26T12:50:10.502+00:00"
}