CVE-2026-79619: OpenZFS: user-namespace capability check allows unprivileged local authorization bypass

Severity: high (CVSS 7.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-26 · updated 2026-08-28
Weakness: CWE-863

Description

On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.

Affected products

OpenZFS: from 0.7.0 before 2.2.11; from 2.3.0 before 2.3.9; from 2.4.0 before 2.4.4 — fixed in 2.2.11, 2.3.9, 2.4.4

How to fix

Upgrade to a fixed version: OpenZFS 2.2.11, 2.3.9, 2.4.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-79619 or the next vulnerability affects your stack