CVE-2026-79619

On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.

CVSS

No CVSS.

References

Link	Resource
https://github.com/advisories/GHSA-mhf5-q8gw-qg9v
https://github.com/openzfs/zfs/pull/18959
https://github.com/openzfs/zfs/releases/tag/zfs-2.2.11
https://github.com/openzfs/zfs/releases/tag/zfs-2.3.9
https://github.com/openzfs/zfs/releases/tag/zfs-2.4.4
https://seclists.org/fulldisclosure/2026/Aug/40

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-26 13:19

Updated : 2026-08-28 15:24

NVD link : CVE-2026-79619

Mitre link : CVE-2026-79619

CVE.ORG link : CVE-2026-79619

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-79619", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-79619", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-26T15:47:13.454769Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.3, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/openzfs/zfs", "vendor": "OpenZFS", "product": "OpenZFS", "versions": [{"status": "affected", "version": "0.7.0", "lessThan": "2.2.11", "versionType": "semver"}, {"status": "affected", "version": "2.3.0", "lessThan": "2.3.9", "versionType": "semver"}, {"status": "affected", "version": "2.4.0", "lessThan": "2.4.4", "versionType": "semver"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-08-26T13:19:24.003", "references": [{"url": "https://github.com/advisories/GHSA-mhf5-q8gw-qg9v", "source": "security@ubuntu.com"}, {"url": "https://github.com/openzfs/zfs/pull/18959", "source": "security@ubuntu.com"}, {"url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.2.11", "source": "security@ubuntu.com"}, {"url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.3.9", "source": "security@ubuntu.com"}, {"url": "https://github.com/openzfs/zfs/releases/tag/zfs-2.4.4", "source": "security@ubuntu.com"}, {"url": "https://seclists.org/fulldisclosure/2026/Aug/40", "source": "security@ubuntu.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed."}], "lastModified": "2026-08-28T15:24:38.600", "sourceIdentifier": "security@ubuntu.com"}