CVE-2026-79619: OpenZFS: user-namespace capability check allows unprivileged local authorization bypass
On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (eg create, import, destroy), pool event log access (zpool events) and fault injection (zinject). Exploiting the problem requires only that the local user is permitted to open /dev/zfs (governed by local device permissions) and that the kernel permits unprivileged user namespace creation. No prior access to the target pool or its underlying devices is needed.
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Linux systems are exposed when unprivileged users can open /dev/zfs and the kernel allows unprivileged user-namespace creation. The issue does not require the user to already have access to a target ZFS pool or its underlying devices.
What does an attacker need to exploit it?
An attacker needs local unprivileged access, permission to open /dev/zfs under the system's device-permission policy, and the ability to create an unprivileged user namespace. No host-root capability or prior pool access is required.
What can an attacker do after exploiting the authorization bypass?
The affected ioctl checks can authorize operations that should require root, including pool administration such as creating, importing, or destroying pools. They can also access pool event logs through zpool events and perform fault injection with zinject.
What can be done if updating OpenZFS is not immediately possible?
Restrict unprivileged users' access to /dev/zfs and disable or otherwise prevent unprivileged user-namespace creation where operationally feasible. Both conditions are required for exploitation based on the available information.