Vulnerability Description
On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.
Related Weaknesses (CWE)
References
- https://github.com/advisories/GHSA-mhf5-q8gw-qg9v
- https://github.com/openzfs/zfs/pull/18959
- https://github.com/openzfs/zfs/releases/tag/zfs-2.2.11
- https://github.com/openzfs/zfs/releases/tag/zfs-2.3.9
- https://github.com/openzfs/zfs/releases/tag/zfs-2.4.4
- https://seclists.org/fulldisclosure/2026/Aug/40
FAQ
What is CVE-2026-79619?
CVE-2026-79619 is a documented vulnerability. On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local us...
How severe is CVE-2026-79619?
CVSS scoring is not yet available for CVE-2026-79619. Check NVD for updates.
Is there a patch for CVE-2026-79619?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.