{"id":"CVE-2026-79619","summary":"OpenZFS: user-namespace capability check allows unprivileged local authorization bypass","details":"On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.","aliases":["GHSA-mhf5-q8gw-qg9v"],"modified":"2026-08-29T03:30:30.886765748Z","published":"2026-08-26T12:50:10.502Z","database_specific":{"cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79619.json","cna_assigner":"canonical"},"references":[{"type":"WEB","url":"https://github.com/openzfs/zfs/releases/tag/zfs-2.2.11"},{"type":"WEB","url":"https://github.com/openzfs/zfs/releases/tag/zfs-2.3.9"},{"type":"WEB","url":"https://github.com/openzfs/zfs/releases/tag/zfs-2.4.4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79619.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mhf5-q8gw-qg9v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79619"},{"type":"FIX","url":"https://github.com/openzfs/zfs/pull/18959"},{"type":"PACKAGE","url":"https://github.com/openzfs/zfs"},{"type":"ARTICLE","url":"https://seclists.org/fulldisclosure/2026/Aug/40"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openzfs/zfs","events":[{"introduced":"ccad64314ab55963c1a0731ff62c8cf6c6976f28"},{"introduced":"bc06d8164b8b6673ca2dc9b36090f91a5d6348b3"},{"introduced":"743334913e5a5f60baf287bcc6d8a23515b02ac5"},{"fixed":"f2d87f5c724ccdbb27a11fb84c4a185e0a917598"},{"fixed":"4c0eb7203e5a2b147d1d5e27b5e2a3461a95c1dc"},{"fixed":"71a9f9578616a90c3c14bb59629fb4d31bfd68d1"}],"database_specific":{"extracted_events":[{"introduced":"0.7.0"},{"fixed":"2.2.11"},{"introduced":"2.3.0"},{"fixed":"2.3.9"},{"introduced":"2.4.0"},{"fixed":"2.4.4"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["zfs-2.3.8","zfs-2.4.3","zfs-2.2.10","zfs-2.4.2","zfs-2.3.7","zfs-2.4.1","zfs-2.3.6","zfs-2.4.0","zfs-2.2.9","zfs-2.3.5","zfs-2.3.4","zfs-2.2.8","zfs-2.3.3","zfs-2.3.2","zfs-2.3.1","zfs-2.3.0","zfs-2.2.7","zfs-2.2.6","zfs-2.2.5","zfs-2.2.4","zfs-2.2.3","zfs-2.2.2","zfs-2.2.1","zfs-2.2.0","zfs-2.2.0-rc5","zfs-2.2.0-rc4","zfs-2.2.0-rc3","zfs-2.2.0-rc2","zfs-2.2.0-rc1","zfs-2.1.0-rc1","zfs-2.1.99","zfs-2.0.0-rc1","zfs-0.8.0","zfs-0.8.0-rc5","zfs-0.8.0-rc4","zfs-0.8.0-rc3","zfs-0.8.0-rc2","zfs-0.8.0-rc1","zfs-0.7.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79619.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}